{"type": "bundle", "id": "bundle--321d2e1f-b49e-4a7f-b481-af3e860e28d2", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--848f6519-0a94-44ca-90a9-b840f1def475", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9", "name": "DigitalOcean Toronto", "latitude": 43.6547, "longitude": -79.3623, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "CA"}, {"type": "location", "spec_version": "2.1", "id": "location--80231c01-31b7-4e05-aff8-e70ad8362e48", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--cd8320c1-d661-4322-bfd3-0183482991d0", "name": "Vultr Paris", "latitude": 48.8566, "longitude": 2.3522, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "FR"}, {"type": "location", "spec_version": "2.1", "id": "location--dc0f6a58-47f1-4531-b6e5-09f55c320471", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--d6ae9f1d-9d05-4594-8da5-8207c093c7da", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--f3933941-f6e2-44d1-b794-61b51dab54b7", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e37d123-45e8-4d2e-81e0-5aba4fc86996", "relationship_type": "located-at", "source_ref": "infrastructure--f3933941-f6e2-44d1-b794-61b51dab54b7", "target_ref": "location--848f6519-0a94-44ca-90a9-b840f1def475", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--5e2ae329-d1e7-4ef6-ba7d-60899b2e9629", "name": "DigitalOcean Toronto", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--096d3b5a-ce9b-41cb-863e-f410de539172", "relationship_type": "located-at", "source_ref": "infrastructure--5e2ae329-d1e7-4ef6-ba7d-60899b2e9629", "target_ref": "location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--bc37f5c1-b310-4e6e-98b7-255fd38b7d44", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--e58fa8b2-1da5-4ee1-a67c-c1257b10c450", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--73a80c75-3d04-4bfb-b823-5392cf208d20", "relationship_type": "located-at", "source_ref": "infrastructure--e58fa8b2-1da5-4ee1-a67c-c1257b10c450", "target_ref": "location--80231c01-31b7-4e05-aff8-e70ad8362e48", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--b5e01484-d232-4b31-bf5e-864333a6e7d8", "name": "Vultr Paris", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a56ce9bd-b386-4a97-b350-c0d615e46e76", "relationship_type": "located-at", "source_ref": "infrastructure--b5e01484-d232-4b31-bf5e-864333a6e7d8", "target_ref": "location--cd8320c1-d661-4322-bfd3-0183482991d0", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--d9cceac8-6d6e-41ff-9f59-32fed5792392", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eb6627c4-8f90-4d77-a45c-9ae9964e7943", "relationship_type": "located-at", "source_ref": "infrastructure--d9cceac8-6d6e-41ff-9f59-32fed5792392", "target_ref": "location--dc0f6a58-47f1-4531-b6e5-09f55c320471", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--14d0df41-42dc-41e6-9ad3-08e6e237cf9a", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--2da8283e-51cd-4f01-a124-d12a7d89b0bb", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--9da2f1da-4258-4266-bd28-88d886934230", "name": "CVE-2021-31207", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31207", "external_id": "CVE-2021-31207"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--611c1a3c-aa7b-4f86-84c3-43bc23370cfc", "name": "CVE-2021-41773", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--e38995d3-0612-4c44-8994-31701747295e", "name": "CVE-2021-42013", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1743579d-7202-4228-90a4-37531d2fa53d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.10.214.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7926240f-053d-420e-bac1-a4ffe03cb056", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.15.14.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb69c85-8292-4023-8101-5d786efe079b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.162.225.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82efb8a4-439d-4f67-9d4b-7a31a003189b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.20.252.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe5a5bc-f8a8-41d2-b691-95a7449276bf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.214.214.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eb4b42b-c7b3-433f-bd61-2b45033fde89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.214.29.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f14c190-72c2-4967-aaa1-d1d7cb2519ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.222.42.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e4d39b7-fa78-47c0-9200-5aeaa469a5a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.32.57.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3cd3c02-b655-47b6-ba0f-2991134ca9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.28.153.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56b59d8-a414-439e-a46f-395d0e9d4bee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7698a03c-3278-4ff3-a870-39fdcec4187a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c361af-59d1-4b3f-8cf1-5652294d6d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5259288e-f8b8-4e5c-84c8-15f15a7066ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f075a1a7-4a8e-4b8c-85fa-c3045b6bcab6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9de91739-3a3b-4be9-b4e5-34117bbaed5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f1f51d3-2aac-499e-9315-497e5458d76b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94e3ddff-6797-4382-b601-c4db231718cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9523e930-9447-4ae8-8993-d6dde88d3ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a3d2960-2340-4d6b-89f4-b8becb7671d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9468d5d-4c59-47ce-a131-738fd1eaec0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2171f1c2-a201-462a-91fd-d8a59000fe2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8520e6ba-aa15-405b-8a3d-58fcdff57cee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4602a9e-475f-4f35-a9c7-21046e991de5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55afbad7-ddac-4237-99b0-dfc7c622581d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4d2e8ca-92f4-4755-a1bd-0e03744835c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.49.117.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cab5c4f-f266-4500-94ce-3cf6ceced6c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.50.17.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f538436-7ed8-4a09-b365-c854a10fb668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.53.171.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7f575b-eefd-437d-8841-af6891492e45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.55.74.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292deae9-6810-485f-b9d3-40196f49e436", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.33.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe6d5dc-8924-40e9-87c0-655db8a5e7e4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.85.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45805681-9b90-426b-ab7a-83b10110e933", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.230.144.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9bc09d1-7966-493d-a0e1-44e062c5ea52", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.141.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b892035-cc8a-4340-86ba-b65732344652", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.33.66.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7208d26c-9b85-45f6-abbe-919b5d5f805b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.104.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d16bb76-a7a3-427d-a7b2-f9a9e53ebb39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e5c5d9-175c-4e98-805e-b240d4cc1d3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3726a38-ace6-4777-a62a-b53da17c6100", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b7ed404-74c3-4901-89c2-219b785d0fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db315db-b281-40ac-8c57-e13fee506258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.112.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac5308cc-00f4-4ac1-a938-c5beac19a892", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.114.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0582b57-d6de-4ef1-9f15-a6c170aa03cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.116.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a3ede10-1875-4d4c-8bab-ad1487280e84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.118.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--664e8091-46e5-47e1-a7eb-fe01d3ab7f87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.119.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--262ca88b-852d-4676-9403-0775657d849e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.124.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e489a6b-3ec7-478c-aff6-1f5345da925f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7689fc56-1ec4-48d5-bccc-ddc9cc09be2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7439b027-8549-4531-9030-ee7420e0c655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19a36375-023d-4448-bc64-77b843617ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--791cc4e2-4e48-4c58-92d4-e885f1bb827b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.43.6.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e396963-a4b3-4eb0-b7c8-4453942108c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.44.36.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9457701-ef46-4996-8e51-e45ed9d9d20a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.156.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58f75de5-dc15-47cd-899b-4e8f00049ff8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.159.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d6226d-a561-431b-9925-f197ffe5667d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.89.134.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c54ff2-7dc9-447e-8f0b-f40b7564c06b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.102.183.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f49ef1f-aa9d-4dc2-99c9-a9dfa18cb0dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.186.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e39c985f-12b9-4978-acdb-2582f49bc83b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.200.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e367facc-fabc-419e-a00f-bb110762925e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.182.215.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0b115e0-71fb-4c92-aa3d-26e7f84cdefd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.182.245.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d7bca63-b3ac-446f-a819-87c4bb47db7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.69.208.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb6551d7-232e-4c38-a0d6-521e3d0c6c7a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.137.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--493d68f0-5fd2-49f4-9ab3-6c7563f7c0f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.1.210.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16744f44-2419-4ec1-a919-77fbc54c6ce5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.107.98.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad290950-77c6-4e93-a81d-a8703aab5093", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.118.28.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d15471da-1578-4d45-a32b-9a6b6b207d66", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.119.18.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bcac25c-83bb-4f05-81a0-9c958a809c06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.124.172.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67a219ce-a5cf-4872-aa83-b36692c3e2f1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.133.63.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba442aca-2263-4374-9664-42897022a3e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.134.250.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--880a0f25-0b39-4775-8117-00c9603e7c32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1866938-5853-4e2a-b0a0-f06e33755d42", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.143.11.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64733bf-19f5-4ea9-9c51-f333cf73fc71", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.146.23.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--395af791-2be9-4ab8-8fc0-da9d73d4b23a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.187.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bb2eb8c-3892-41be-8dea-6e3822317507", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.151.42.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce3479a4-1a26-4ee5-ad14-4f8045f65c18", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.152.48.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a515f22f-85bc-430c-af41-53ad1672e754", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.153.130.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac77478-0dcb-45bd-9b4f-f96fd5b7598a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.153.190.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7890f513-7d62-4151-95b9-a3eb77ecbe0d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.154.77.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df8a2071-b5a7-44cd-bf27-c21b33c9d3e6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.164.107.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c88dad2-7ffe-478c-b35d-74993dd2dc56", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.169.91.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6fcc9b8-86f4-4249-af60-c333f722c578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.170.214.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5318d50f-6f78-44ae-925c-f9fbc63797c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.227.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29cd44c4-ad97-4f5f-918d-e54df96461f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.176.90.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09419d86-0782-437f-8dfd-7ba27a5c41c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.197.112.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d42e6c5b-aba1-4aa7-8a67-da6a96fb669b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84eeb8d0-2edf-409a-910b-736123290a3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26399472-7188-4c7b-9fd1-fdf199e2429f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.59.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31804cee-601d-46e3-ab0e-26d4af2969e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.205.17.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54394690-846a-466e-b372-6db720b3a1d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.214.62.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837b1200-c65b-4779-8360-1fe74375263c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.215.203.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c57a5d-5f91-42b0-b2a6-5390ffa66768", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.215.80.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b257ef34-8af4-4160-a2eb-795adc352daa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.218.159.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2960dbdb-58dc-4904-a399-a2ec5b193c9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.218.240.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6476518a-096b-47e9-bff9-dc7216783315", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.226.200.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05fa4dd2-b6e0-4ce3-842c-8462edb30245", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.229.125.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d40baa28-b4ee-4419-88ed-58d72057ed7e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.230.120.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501c201a-9706-4219-bcd6-856dcef81b86", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.233.206.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58cbc8e4-69d1-433a-b31d-a69c04560e55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb381e5b-b30b-40ea-b7fe-0333837ea9ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fba30aa-3451-4cb2-9edf-cfe6e84f9422", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09842818-63a3-43be-906e-7d348c5edfbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b220fe25-d8be-4666-a491-3e1b1a280ee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d61291-9cb3-47c1-9672-4a0818425729", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795bf072-d537-453d-9cdb-b6f264182650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e3894f-5d71-4f0d-9bf4-06ece11baf48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5c9adf6-1ca4-4361-bd34-6eabc2c15b2c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.236.140.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6757e8d2-49b4-4b52-ace6-d54dcd5d960b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.241.45.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f6ea428-7de2-45a5-9cc4-51cd97a9b62a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.26.189.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64662553-9050-4315-ae76-acd821729106", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.27.108.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03e84c4-3bed-4bd0-851e-5ad52ffebe64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.31.82.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d559948f-f835-46ba-a6d9-4b4842828d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.61.44.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--537afbda-b5e1-4254-ab25-8cfb95d16974", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.67.80.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5321429e-b715-4de9-9464-25e8fe3f0296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.72.9.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fd5772f-7ce2-4848-948d-ec380f507d95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.71.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a258d79b-b7eb-4be1-b48a-36f35366a196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.75.71.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71468888-42b3-43b8-9615-a0b2b1cbeddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.9.204.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--556c4dde-9924-4d0a-aa7b-21ec475ad8c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.91.206.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e621c4d-a5fb-49ab-adf5-21a873e278e0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.98.176.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef20777b-6f43-4d3f-90ae-a32d33cc69fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.169.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b41edd7b-8cff-466f-ba6a-7716f8f5c7c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.59.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b48be6-829f-4c1f-9ecd-6743142858f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.10.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4d9982b-4b61-4b8d-ac40-90721b0cec9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.9.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb020210-916d-4c20-93d7-383311058f8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.199.7.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324518f7-9131-4a62-aca2-46465dd68b5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.210.140.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972fd86f-ae47-4ff1-bdf8-8064c52efbfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.232.79.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3899f93a-84ce-4bc7-a42a-cf49f0d1b26a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.51.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72db280e-863e-47c9-8851-e4f0fe358335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.66.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32054a66-4acb-4d24-bb99-7d0cb6100cd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.156.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--993b1982-12c1-4ac2-bf26-812764e9b5b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.238.81.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecc2f659-67f4-4b91-af3d-dd130ff90a5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0e74a54-4517-4ec5-9395-ef97c09f1054", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37881cee-42b3-4142-a135-54b83e0a517b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.37.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--296eaf43-8eaa-4118-a553-93cdeeaf6e2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.38.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb9434b-d810-451c-824b-913a7a58fc30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.1.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14f1742c-79e4-48da-9e1b-4d529857f320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.235.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--856759d3-898e-44d7-8786-aef5bd0d8d7c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.50.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0bb18ec-c4d0-4577-9cdf-cb266e4ea2c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.81.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb47de1-6bbf-46ae-b974-301a197feddf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.249.62.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba359662-0cc4-46b6-ad45-7af437fc4275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.251.180.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81d3e860-6a03-4413-822c-942f207feedb", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.156.122.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3e89a3-32b4-4829-b30e-c7d5762ac6ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.168.38.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf475b05-02d2-4dc2-9143-11c4f9bb33a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.117.104.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--367f6bd9-1cf9-4c79-83b3-a2e95d245cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.117.106.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82382f09-7a87-4514-b017-0bb73f58b3f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.117.107.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dbfb0a0-beae-4c4d-9d56-bea0badc1958", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.108.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84cfb210-3fac-44bd-9673-9aeb859bb053", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.18.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce1e0065-00c0-4d7e-8607-d83352e98c7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.190.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64018e6-d527-4f95-8a03-9e5a1aad58bf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.88.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adea33de-f049-4035-9b7f-45527eaf4ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.14.183.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3eb7de4-02da-4ca3-9c2b-aac5d4bb3c9f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.219.146.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7db320c-5f14-4aeb-8dfb-011edf69faa0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.222.170.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5721d74-639b-4b76-a8f1-9ea8ec0b38a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.137.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a37dbade-a508-484b-9009-d0ca5245eb58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d96bb8b7-c4f0-46ac-984a-cc017e213790", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a375f9-ee72-4f90-8f15-b9fc61cfd248", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bf88e10-98e7-4bcb-8b34-7ce92cea9f31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.154.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6897eb4e-75d3-4f31-a6ba-695941674ed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.176.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb4eb721-b6db-4c76-bd3e-e825acff722a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.184.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8198aa2b-cbfa-410c-9dd8-f0d5e92a99c3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.239.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11d536b-9249-4471-ad15-1a660fb56e8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.148.89.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--560345c1-e4e5-4971-a4f8-cf4a9ced2255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c584b0fd-23ec-40ca-b27c-28a224d10111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c4107ae-0660-4a8f-ad33-03cf7ac28f7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.102.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b641889d-e502-4132-b066-c1a3e776dca9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2879ff81-1083-4d4e-904e-3d05640b4816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1590b001-6721-489a-b0ce-47c6a009fb27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d020abe0-db00-4fba-bb2a-917d9d6c1d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--528ab77e-4b52-489c-8413-be6cf78159e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6449aeca-b502-40fd-9cf5-911539223f8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.104.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c72d2d14-50b6-4bd0-bd54-7da6537d31a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8274523b-b880-45ac-bc6f-ea83f4e54828", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b51d2c1-7c56-4e58-a2c2-0f40ea775445", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8389a257-bb55-4952-810c-31b4f4bea3e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.111.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1f9ed02-d4ea-4fdc-80b8-1f8251792c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.111.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--677cbab3-b951-49c2-9864-a4a54bcce36d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.112.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--139e002b-7fbc-4328-892f-52922407e2dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5975044e-dac6-4aae-9d08-7220b6639a9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42eef0e4-dd95-461f-b3f2-a1d9b8102fab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f47b80d-22e9-4044-9591-f168256d8202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa2959a-def1-4153-8408-3e3479497840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.155.56.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d0cade-8aeb-458b-a767-f0f011167a1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.247.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0671af4-b499-4f64-aa5d-fb651e48b539", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.128.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ce6c480-7a0a-4518-8e34-a03120db8dbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.88.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd6e15b5-4415-44ef-883e-8eb881729856", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.173.182.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3348a7-919f-450f-92e2-a4fe8f6ab9ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.175.196.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4add938-db65-4ce0-9eca-ab95367728f7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.180.88.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65e043d4-bbd3-41d8-87b1-f684c6d8b858", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.27.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fcc4621-c32c-4824-b656-c68c26cf9c71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.190.148.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31526040-e5cc-43f2-aced-b5543f2f9ca0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.6.164.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7dc53a-b96e-4481-8267-e8b6862d96c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.178.7.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75a75fd2-5dee-43e3-9294-514919599002", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.2.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--893bffa9-7a46-41e1-8b20-4f57d7fa0e01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.22.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7947fb-1f3c-49dc-9eea-a8a0b8c9f56c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.6.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcb1edb7-c882-447b-a07a-3907c576683c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d29d385f-5ee7-4fdb-93a5-a25e1938d3a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf82848-4e2e-4970-813f-e17d8663f0dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3f4705-6603-4e2f-a516-b7bdbc9d99f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15ca996d-ab3b-4fec-815b-6448d01f0564", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5410440f-33b3-4619-8a7c-9dc6546b3075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50aa88c0-402d-4ea2-860f-aaf2c87b1b93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab165e62-1ade-4bce-80cf-88e9990ce22d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1c40540-a5a8-4d86-8fb9-7159bdb5ef52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4451cfb0-187e-4d0d-987f-fbc97d58e225", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1311e782-6545-4c06-8c38-be4c1d37887b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.117.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--967adbb7-0f22-4c54-b9df-cacf77edf323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.186.77.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff5dcbf-6fbd-4e55-8dd8-98fe213e2890", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.199.104.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27c07a93-abbb-4cea-8f4a-1b2dff7a4069", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.206.241.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--731fe8a7-9966-4a66-a6b5-8b48dfbe6351", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.229.27.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ef54e8-4fdc-46a9-8e8a-d27787195d09", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.247.190.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b90e371f-5fc6-4786-8cfe-7269366b794d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.76.61.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a841c80-d8a1-4a62-a0e1-3c1bfbfa32c2", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.10.176.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b18b2f7-3688-4529-974b-c001fcfa4b19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.177.182.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abacc73e-9d8f-4ee8-91d4-825a44b4e486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.47.238.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3424b6-3017-4e8d-b9f0-1f80dbcbdafd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.88.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b33b63e-a37c-4e8c-9729-a770303e4a23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.88.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4d897ed-5b0c-4adb-9094-cc21e56c0de0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.89.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--563448ad-81e3-4616-af9a-74317c8d3ba5", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.120.61.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ad91148-3d2a-4823-8bb0-c096e871a41b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.123.41.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f40c0a4-d231-423f-a396-f0ba7b5e6a15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.53.147.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7165104-3d14-4e55-a1b1-df8e7de48e5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.61.116.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ec5501f-fee2-41a3-a763-acdefb92f6db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.7.172.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb441eeb-003f-467a-9376-cc8229fb9906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.74.134.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0c8dea9-2210-4454-80b4-d02d62075958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.239.99.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--693114c2-0632-4267-918f-937b5d81f4a3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.248.106.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2381237-7162-4c74-89ed-a208624f2d95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.212.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--357f4e16-7014-47b0-be22-60bbcca136a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.213.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c28952d3-fd64-4484-99cb-1002a621ac8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.214.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47a2f96f-9b86-405c-8580-a6a2ddb426e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.94.251.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03c24118-7d06-4e4c-8585-0195a03b27ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.211.127.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09eecac0-ee3e-49e2-ac4c-4a199ba86c97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.211.85.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a4f134f-d373-48f2-98c2-75420fb087db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b849ed1e-0ea7-4e9d-af21-ec21308b7ff9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1663ae96-8591-46da-af31-c0c64f719f02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c047a3-d93b-4512-9b5e-c7139b9c0dda", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bbc0897-a7fe-4a45-ba71-5021a17ef6fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edfdf9e2-d1fe-4d66-be8a-d1fbf1a93a08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9c0fa4e-84fb-42f0-bfd9-4179f1772131", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57533631-90e0-4c40-8452-f9c640f9a47c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1cf51f7-7686-4dbd-bdbe-b92638f7ea34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1c8320b-8744-4912-b27d-636dc30d123d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df96960f-0775-46c4-8d96-fe481e616b16", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827a47c2-f3bf-491c-bc96-093ad3674dff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44cc3c34-b787-49c8-91af-286424588b3a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ebfa038-7a1b-4de0-964f-1d72d2dd1451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.223.254.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15996f83-f71d-4cec-88bf-cf91a56237c6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.55.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6131eabf-831d-4bc6-a5c5-bb9438d473e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.131.20.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b2e1f7-fcc1-4cf7-aba0-1b3310d27907", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.179.102.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072fefc3-163a-440f-af70-00c89c510432", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.138.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c70d44-0ca3-44df-8056-61b51d6f3196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.149.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d15eab95-3f0d-4cc4-a24f-dcbf80371f3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.192.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c91fbf8e-b9bd-4f08-abc3-0029fe06a06c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.191.11.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46088cb0-f6cb-41ce-bd50-68cef48cbf5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.191.27.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61593970-0431-4a53-b30c-f32ac0d4f5b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.206.98.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1d19496-4b20-4dd6-b41b-a806aa17bed5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.212.136.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be3724cf-fbd9-4b1f-b992-c2efb9c27ada", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.220.247.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bc3e81c-ab03-4f90-aa7f-7ee936d225a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.229.210.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94403e98-4f2a-4f2a-ad24-dc2b807e6b43", "name": "Malicious Host", "description": "Observed: REDIS, SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.231.78.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c23e86-71ed-4948-989d-fbbac9175b4e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.11.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10de1508-6c61-4095-836f-330df3e1a14d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.145.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71f135b8-ee01-4d6c-9031-419c2c8abf5b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.16.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0df221-21cd-45d7-9376-cd3e8f8dc752", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.2.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a73c029-a3d6-4dd3-9071-4d92c348ad37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.214.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb200950-dacc-432c-9282-be7d1ca94cfc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.110.7.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74b3d1df-e73a-422d-a955-5074f33d9607", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.117.82.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7b22566-d5bd-44b8-886f-3635cafc76ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.172.249.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652946c1-bd59-43a1-89b2-db3da7979cc8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f19b98f0-40a8-49bd-adf2-5cd349267942", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e57848d2-448b-4973-ad1b-3148794aac35", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67752486-5460-4e07-8c5b-b73cb349634d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--518125e2-280b-482a-b2e8-1fc595541680", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f61f86-342b-479a-8111-f262caa791c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.198.236.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2af3076-29db-4cfa-bc60-f1d4f9ba4d39", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.30.192.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f3ccf9-99cb-4534-ae70-ddec4d6b1baf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.164.191.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5006b15-7f36-44a0-8def-2bb768060d70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.175.140.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c0afa2-409e-498f-bd60-09b248ce0ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.33.242.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d81fdce4-0243-47b2-9907-cf3606bb7b92", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.50.75.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--112112f2-cb8c-420a-8a59-71749707ea1e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.140.240.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--915752fc-9633-40e2-b129-c35a787d75c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.186.7.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f97430eb-54c8-4dca-87ab-be93c69415dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2a9f625-7e17-4a71-a052-0ed2c9c55733", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0782124a-2fc9-4258-9950-3f020b6ba95c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a3eb046-7dc9-45c9-bcde-d84aef697394", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.40.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a41a4aaf-0bc9-4e6f-a66c-8ad857ab461d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.43.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--334972c6-d87c-4aeb-b725-465a2455f071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.44.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f65fe823-adc7-44f8-aa8b-2c97abb4542f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.47.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--039bdb0b-0a47-497d-aec5-542a5c3a6561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e5d5fc-ff06-40cc-b32f-427b7aba9a71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e646c6-2d3c-4931-bb92-2f7acad4c26d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92eec7b9-53cb-4a9a-acb3-4ff671f8a3f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85e2eb24-592a-4a32-999c-96864d7f047b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5199945-f8a4-48cc-8fa6-8f9863bdce4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab23aa2c-5b4e-45da-ae0f-92c878f47438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.61.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--892eb961-c369-40a5-8a62-76fa586198bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.64.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9217e9ef-9862-402d-8bf6-24693da849a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a2e9f41-036a-4a80-9249-02407c17b09d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--254785ed-b1ce-460f-b5b0-6835ffab0785", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eee53ae1-4d3b-42b5-95da-544e459346d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.68.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e670a68c-3feb-4c1d-90f3-550cc11b0c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.69.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fed43b0-dd7d-496f-a564-47497108cbe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.73.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37d8609f-f841-40a5-aaf4-fbce5eb7af02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--961cb825-6659-49be-93df-4aebcabf7f77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90bec8d6-ca81-4333-93ad-5a7ad8486114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d18c60da-2204-443e-8eb3-f1bbf5057593", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce8a2891-0166-46c6-84b4-303794f4c3b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.233.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dab3244-43d3-48d1-a421-08f00f652bda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1ace75-1a19-47ea-89d7-c92ff7ec239a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7fe2749-85a8-4220-a829-a392b6e69d7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.235.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e6e1ad0-8d2e-407b-87b2-5cf22391de74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.249.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--426a854d-c1ec-4df9-ab69-ae7c7be2d582", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c694d8b-71fe-4c67-be8b-1421ae1e595f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc1539a9-0e0b-4f57-96ab-819cbf6246f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9caf8a1-60c4-433e-b05c-ece47f43f7be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e73636-84c5-47a1-9e6c-9dcfa51cefa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c672ea4a-993f-4e9a-93a2-bf66960ce4f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f88441-041d-4559-bfb5-cc03f47d24fe", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.196.64.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c1eb75-3482-4f4b-b85a-97a38420e66c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.216.88.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b2fb924-1853-4ac4-8c10-6a07055a180b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69408edb-e7cc-4f2c-bf30-234e43a2ed35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d257ab96-9565-476f-b663-07f283195147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ddc3888-ff22-4cb1-ae37-dc39b31f468d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.109.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe891873-c23f-434e-b520-34cbb64d4608", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.36.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50c25497-d90e-42d5-b2e1-e3692d2dea69", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.13.79.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dee255cd-1799-4b7a-a5ea-a042326864af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.130.0.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096be97e-3872-49d3-947a-be8287608307", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.249.100.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--498c58f6-34ab-47dc-bcd5-4e65dba72b0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.253.93.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941b3291-651d-48e0-9539-4362c0de239f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.100.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d40fa3-a53a-42e3-ae50-f41859ac16fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.106.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ee0d61d-3b24-4138-a53d-ca86b8894a8b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.107.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca294ee0-cc53-4b5c-bf21-e85a73275524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.114.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f6f2994-1308-402b-b77a-8512aaea8718", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.118.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3717f2-6587-4953-b788-07175505b0a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.96.173.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d044eca-0e7f-4b3a-8578-c1b12bf7e552", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.96.81.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77e133b6-5d6c-4549-aed8-16df0f84096e", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.201.126.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--500f2e0a-184d-4b46-9461-5f00fd16df32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.24.119.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d20e74e-14ae-4cd5-a52f-59d12aa405c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.241.117.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f5ddfd-8d3c-4c2a-9b72-26bf05fed3aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.241.79.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d790469-664c-4d12-b6e5-d0206537faf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.76.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6461f75f-0943-4de8-8b2a-eacc9ac0046a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.92.105.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac717500-9796-412c-8766-39811d8ce11a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.133.110.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e267e7bf-092f-475d-9ef9-9a4cf601e657", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.141.189.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3274ef21-5360-4dae-abe7-72eb55cad070", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.169.23.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a814a486-5b8a-4474-903b-c838ec5647bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.171.125.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e771b7da-46d3-44cb-aac2-6c206b8eb809", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.227.152.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea79cd63-7e89-458e-8310-8ec543f7f988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.29.149.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d5b36d8-d1c4-42ba-8ef6-8b432c2ef515", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.41.116.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d231158a-34c7-4002-8223-e4d7c76c13f9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.43.96.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8571af8c-48db-4df7-9d37-7e25c1a379a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.78.125.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76441f07-5770-42c7-9858-33482a2e4e47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.2.49.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c7d0dc-c814-411e-abbe-38c7922bb657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.51.216.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8faca54f-2436-48e6-bc9b-2fc45095def8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.51.236.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c20b303c-ca63-4f61-afce-7a4b1da97c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.28.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f03181a-8bee-478c-9a54-bd7d65bd4f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.138.72.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b4b6f7-8075-4be8-8de3-3254dd72e67c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.16.178.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ee9ebad-f1d2-46df-b966-bc284ef6e7f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.173.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e7ea78-ffef-4d31-ac37-65f7e04edb73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.223.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecea1247-e027-4855-b27b-d46a09aa901f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.223.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--495205b2-436b-496a-9c20-7b1360ea6333", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.160.234.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad17dbd-9e9e-460c-bd40-3235c01d6e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.178.210.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788df880-18ed-4722-b536-a6aaf36938c5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.207.65.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8e788c6-53c7-4b67-893e-1a211c6b86c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.245.84.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03187eda-fdb1-4f07-ab67-03dbfb2eec20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.200.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d14f962-e2c9-48b1-8559-0d3b6abadb69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d5f7563-5fe6-4da2-9ff2-82fa4990f641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773dfc08-2f69-4cca-9d09-39b3892175af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.117.193.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85fcd237-0ff1-460a-a694-da435fa770cf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.155.125.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2be9d02f-9f12-4a8b-92ad-661900a526a1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.156.196.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79e160f2-d425-47e5-a5d6-ada370224e12", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.156.226.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d988b2-320a-40bc-889f-62ee9dc02a8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.158.5.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56045ab6-4e08-496b-9a66-a2a3b927b238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.163.255.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28769e0-5b3f-45dc-950a-c52e0b0d6fb2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.174.62.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f0cbc8-e818-45e0-a55c-02faad8298f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.131.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed881b22-7762-42e9-aca0-2cd5afd0221b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.131.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfbd5895-cb85-4fa3-ad35-bd08263e0dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.132.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140ee905-a376-4919-9b1d-e6834269d7df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.132.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b169df60-06f1-4ef9-8c0b-0909cda9120d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.226.216.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9055f15-5f77-41ca-b08a-f9965f35061c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.253.248.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ec0427f-99ce-41d2-a1e0-61bd97385b48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.72.224.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5292fa89-bfa6-4104-916c-096f8f095c02", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.112.95.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a6ff649-b624-4745-a436-a14f25156597", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.119.237.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9df0830-ff05-4d92-b1ed-8e8ede632c9e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.138.115.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f60d48-13fc-47c8-b32b-a120e48c3dda", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.227.213.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20fd52d3-7de3-43ba-96f6-ad916585a017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.228.8.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98a3e80a-7bc1-400b-8382-9bc884961fc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.24.66.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98c7dd05-0105-462e-8282-4f5a73dc576c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.25.230.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3c5a430-7adf-4061-ae6b-0f4a9d88647c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.26.227.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce3ce99-baa3-4d40-bd23-b5dd1684586d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.26.231.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--460b8a63-5fda-4c1c-9226-dac6be5dda7d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.39.179.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19ae18d-0da2-47e0-9f9c-6a32483328bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '127.0.0.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de9a2493-dc76-4cc4-a63b-1183a5fc2250", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.0.104.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a79207d1-fc02-4506-83d3-eaa944a65ee3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.0.104.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23a0831e-8a7e-4bab-8df1-f024a3494f61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.34.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a6f2c5d-66cb-435e-a1a2-cb75d19b17fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.226.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e496ba0-30e5-4e1b-a347-de3b9df775d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.232.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff48bfec-f15d-4f6c-9756-f57cd6c14e5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.233.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--584ed8fa-e5cc-49c2-b401-053b71ec2851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95f0c681-09f9-42ff-a228-2e8ad6737267", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--066b7dc2-dc4e-4c90-8572-90ba9bd09e6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--852bcc6c-d7ef-4996-b1aa-f70dbee5cf56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9391331-7aaa-4d39-822c-9457ed5c175c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.173.237.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa1bd28c-6425-40f5-96e3-7581f696c447", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.225.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56a91ef9-94ed-46a3-8607-ca18795bd098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.202.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d85c879f-0791-4d4e-a4ee-6900df17c754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.234.250.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfe80f85-715c-4e8d-83c4-f5c767b0192f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.89.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae3e97c-a6cf-460f-b4e5-67d72a2a806e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.212.236.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cd17589-41c7-42f8-9b80-1ecb06464cb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.224.206.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bc38997-be1a-44fc-9354-a263da909379", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.224.207.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce2bf9e5-9fc9-4ca3-bd9b-8e75bfc93d46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.213.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da24ec0-6c0e-477b-b22f-4ba140b30fb5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.81.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe47620-c17d-4382-9c17-27116c138d55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.212.172.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788300ff-ad18-4a3a-b9b5-8354c24c406b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.169.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f808eb7c-50e1-4580-8ed1-70306054c449", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.29.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134a2147-c058-44ae-903c-a9ca4f962829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.104.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f49dc54-dc38-44ca-8ad7-186b38b150ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.105.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49d5569c-6862-4c1c-966e-c8b23178bcd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.106.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cae5b92-0e88-4553-8cf6-75caa60eda33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.116.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a306627b-1837-4cf2-8610-41a9ad3c225a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1532f88f-20df-45d4-aeb7-2c91ab25236b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a99a28d-87d0-4fcf-84f4-b8d6fe3724b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--940c8a2f-0a58-46b2-a7c6-859330913103", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--997adc74-9725-4bb0-9625-f1421e176d45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a352167-22ba-4328-92ca-b9846d46a444", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb4eb7fa-2212-4f73-8b02-4f3dca891cb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7d3ce7-05fa-4bb6-a007-8c3634703601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30b0949d-9218-44cd-bddc-eede27fbb89c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e67b56f-2de2-409d-a70b-bb4dd1ca78b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9efaf122-d706-4fd5-a31e-8ca066c01157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac748164-92e6-41da-86a2-357e0e45492a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.181.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f3acbfa-5e0a-42b4-a091-9cb3de6b7905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.182.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52e76d67-ff8c-4219-ac75-e9c209264db7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.161.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46652e93-5fc2-4539-a36a-91f0fe9b287c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.211.64.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c59180f-c58a-41f1-bd67-6462478e24c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.161.224.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0f52451-3c9c-45f3-a4a0-20b5d5448811", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.226.110.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--180aad2b-eec1-4521-8507-65684b9b521e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.145.115.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ee9fd3-ca95-42a7-8f60-da366f34ce56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.196.42.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68099f92-3948-4fd2-a802-446ce51d528f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.114.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe45e8dc-b998-4364-a0f6-a49ffd4ac487", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.125.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd437207-36ad-4c06-9e6a-49f73a47875a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.42.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773d5242-3785-41ef-9530-ede5290e1956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.43.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cae2418d-1bdc-4585-b4fe-70d9a40c1e41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.5.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9e6aece-5059-4ab0-8f43-d1667a2307b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.60.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adeb3fbe-25bf-41d9-82ac-dbc83fe910dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.144.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1475c1c-5e1a-4564-87d9-d883769bf134", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.175.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd6c5905-2585-4b42-9e21-50681d51f14d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.199.228.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac52cd5b-0058-4034-9378-fb2e3b983d9a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.179.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa538a4a-8591-4ffe-9963-741e49593030", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.26.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f55fb1af-b688-4c44-a52d-d0accadbef86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.31.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0c2c758-197a-4892-b543-6f2ba0f14ac2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.6.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--748efbd6-8bf9-48a8-b4f6-99b2c58be933", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.65.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14eb4c4e-994b-480f-9891-43df67bff87c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.97.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb8a1772-5a12-4cc4-8c62-4815f7f9a8c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.88.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ab7a44-8bf7-4173-8d63-a1d1d7f62085", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7986828a-6d50-489d-9afc-2ba99c768a1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1e99faa-6690-4c0b-8daa-fb09765cae54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.222.40.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e99e5543-71d8-40a4-a899-d6dfaf6a2958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba78fad7-93b3-4949-8a99-7727a9d6f898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc8fe72-323e-445f-b879-09cc930f6a98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.96.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb4b855f-f9cb-4132-8fa5-5fc45e0ea21c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.123.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c8ff7b-4064-4c8d-b986-5f948f2fb83f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.123.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d442b47-21d9-45d1-8f90-80f866e50a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97660732-00e0-4191-ac44-38fea731843f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ff31cd-fb15-4bf9-be13-e8bdc1ca1b80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc58c069-c209-4e9c-be30-9ad6d6908682", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6000f8a5-be55-451e-a05e-74e24b076b32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d0cde15-7ea6-4862-b0cc-faaac2142020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eb8905a-1975-4488-9e4f-284ccc038e5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07ffde1-208e-4c9b-ba42-9ac4827c8859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb1ad01-708c-45f7-945d-7d827fc25c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4a2f3a-501b-4b3c-a4a6-29fc0d9ad756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--495c0965-5222-4690-a019-da148a4d9dc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--561bc1d3-2387-4be6-964d-e59839fc06b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e97bb8d8-7a96-4356-918f-46fd10327d61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53547ded-87d2-4fdf-9802-db8ea3a39382", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04667ff-862c-4776-9954-9871fbed3d11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1912cc0-2949-4130-a033-9f187469de58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73147c44-0726-48e2-9289-dcc091e993f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0880ca0-5a2d-4e49-acad-762ca50c2d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de7d524d-091e-452c-9379-6ad2bce97e65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8604a814-a3b4-47b4-bfdc-c082012035d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92be606b-ddb3-406c-8326-db5acb4474a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73ed89b-9524-4bfe-8990-aab6581860bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4773eac-c362-48f5-b26d-63865a25b7b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.81.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dcabef2-e58f-4d77-8b0d-a393ceab39ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.158.10.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e54cdae-5730-486c-8473-5866d253e780", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.117.183.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7332e792-d720-43f9-a96f-6667e7ede4c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.1.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24da6851-81bb-444f-b32e-1577c8ecee0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.104.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fb14aad-6af3-4efb-86f9-359be41072ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.129.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fa39c6-1a44-48f7-b331-7151a07d43e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.135.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19f57326-dea7-4343-b85f-e7e00e97722d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.151.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2adc9a8-ba00-485a-8479-6de6acbde891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.166.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57fba122-562a-4504-8cc4-c09d1ebc1a27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.36.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6e6b6b4-6906-4f4f-8b23-c4b2c564d1e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.39.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bce147b-6c2f-469a-b12b-1a1804b75958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.71.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--212b3076-3c36-4af5-8f32-ca7ff21fa013", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.85.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca97e08-56dd-4840-ab7d-cfb3b8c39e81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.59.231.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c161e3-6265-494b-9c3b-02f891ac5a30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.16.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0c8c05-ae6c-4184-9935-aa2c364bc69f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.72.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--327b968c-8d17-4e3a-893c-a1350fb89e92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.219.224.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--338f38be-700f-45f0-a788-689f0d1b484b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.143.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a880b68-afca-4102-a300-837b0ab00b61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.153.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dccfd49-b784-42ab-960f-4d03bd361ad6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.167.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5060a72-0cec-4349-8192-9e901aba164d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.182.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0c5afed-570c-48eb-a5dc-3bd20c722bce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.20.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--458c3e82-1f09-43b5-a53b-5542e22105b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.65.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15dbcecb-af36-4938-91d3-d27406759654", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.9.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a41aa8b1-4c7d-4d31-af04-479c4d3d1fc6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.99.70.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5509d28-6134-47ab-b8cc-a036e033eb84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.43.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394cba6e-50e0-4527-96e8-9ff07f143efd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.235.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1637dab2-bf12-472e-ade9-23bdb53db416", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e10987fc-bf1d-4170-8dc1-579c9a9abdf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a2376d-534a-4beb-b9b0-77f636abf80a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd1f47e-1226-478a-87bd-3e093ce10f46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.113.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6647a312-24c0-4a74-bfea-655c48c30299", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.66.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46685a3c-d72b-496e-a064-7ef98aaff78b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.70.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--556856ed-e36d-4c73-9fcd-00e3cf8b547a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.177.194.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4c80cc-5541-409f-95d8-b629dee9904d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.180.140.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a7735a-3953-4890-9ff2-e610c2c0adf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.19.117.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674dbcb5-a5eb-4aa4-9853-a30fcd42304e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.212.68.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7185701-667f-4191-8b92-04b129954761", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.214.251.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c76fc0da-0a57-4cde-ace2-a159625abeac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.101.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f151123d-c238-4ce1-88cb-e21b6d9070b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.173.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d57eca28-3945-41fc-99a9-f744bc1b02f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.37.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0dca87d-54fe-428c-9633-a8dad86f4663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.56.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d999c9-a437-42ca-a55d-493ed12222a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.77.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c515a6-a3c1-4d53-9e41-040dbefc99fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.1.105.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee6cdf8-396c-4728-afe7-f89af5a1c59a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.107.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb3f8fa8-52b0-4aea-9d82-3815280b4787", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.107.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173c7521-7679-4bfc-a9b7-0f3e17afcfbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.112.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b0fd0a3-4960-42c1-8f8c-93cb1bab37f5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.115.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6e6b40-7458-41f7-a71b-da16b5837e75", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.116.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de825265-3bcc-45e5-9abf-c5e4fa5952d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c53adc3-68a4-41d8-8f83-e5a5f5cdcb23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.120.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7955d7c0-a992-489f-9c22-24f164058bc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.123.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de33d330-b39e-4d74-8654-3025acc5d3fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.123.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b3691c-b1aa-44fd-ab24-3c9b5452bc62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6e57cc0-b947-465c-a159-aac89fe73e5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.142.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ef804a-472c-40ad-bcc5-376564c816a0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.116.148.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab01c26b-5c44-4ad4-ad17-72beb38d9414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.152.90.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4811fff3-37c2-45e4-9153-a8790b651ebb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.179.181.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5183015e-cda9-4983-8aca-6128d26003f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.184.117.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--943fa0cf-738f-4308-be85-863e8a604928", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.194.85.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb108bf-ef57-4b97-91b7-77b5fb05cb2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.194.86.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71cc4fd7-b027-45a3-8d10-4d3944d3f400", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.29.208.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14c77e35-a529-48a0-8834-96b67fe801be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.228.21.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b301a39-e15e-4245-91ad-048f4d86fa09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.233.190.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--524b5778-b3d4-4953-91ab-cb1a65285595", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.245.111.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7dd1bf1-2e37-4eeb-8c4c-fe7a1a98af5a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.11.21.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacbc8e4-4ddf-4b11-a743-da31c0c48114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.226.89.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3f32a54-40ad-4fab-9600-6772bb3361d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.95.34.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7733efbc-d8a7-425e-bce0-bcd5449da64d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b3454c-0689-4a40-b0dc-2a47478bcbc1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb343cb9-8987-443e-be04-18b9423d047d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a23ca60e-b853-4a57-ac65-7bf93e82e836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.83.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aed9e98-59e7-40c8-aed2-ee60040dcd50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.171.24.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--216f9efd-cc64-4c39-a56e-b00a5a6cf655", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.44.247.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39b0b667-5049-423c-bfaf-0f32a1dad5cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.101.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f060933a-e8fd-4492-83c9-6376d1d55699", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.135.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edc017ce-98b7-4842-8779-c0fe443ee181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.140.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfbbc460-9afd-44ba-961e-3a36fc7d736a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.176.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3fe5feb-8fc2-4e3a-9627-3982554cfd7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.224.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5efdc668-2e75-41e1-b112-fb1188e6591c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.232.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39b3ba32-a27d-422e-9ca3-c186d7200cde", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.57.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--637fe239-14a3-4e7d-837f-422a867a5dde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.91.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7da3831-a877-4951-838b-01c1fec3f3e5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.186.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac56b2a6-d77b-45e2-a409-dae95987373b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.227.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--772ea6e6-7b96-468e-8488-5b159dd37748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.155.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1e6e12a-cc7f-4562-85b2-16dd889144fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.178.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c374f3-35e5-421c-bb53-9fb5f12cd756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.212.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca9c99f0-4db6-4427-bd4e-22fc115e0264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.23.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53199e38-666b-4a97-8436-752f1eb6f0c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.98.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5664271f-4ea9-4070-b9c1-cabc0edfae53", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.255.141.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ba099b-bcce-4a98-a2fe-b28f20d31062", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.255.185.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7633eece-7b95-46ac-9d77-7207ad4e4c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1498a7f-0c7c-4b9d-878e-58fe13dff8ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e45d4646-e241-4387-a535-214c88bf48d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--918ee58d-4fe3-45d8-aa4b-1fe6a6ddbee6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501b4d78-2478-4755-946a-bd3f902d1ecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafecb84-c889-4a18-b3d5-68fb0fa7531d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd25279-8ec0-46a9-ab33-b1e79f8e9776", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32fc95fd-f43d-4486-8e56-d9cf2aa6aa94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f74112-22ea-4bde-8cd5-7c8b9af996a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f488a517-f923-42e0-a75d-59445fb8748e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c00b0dfb-f110-4eb4-9f61-50e0db7dcbc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de42912b-42b2-4efe-91e7-090ff5bb0324", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dcff657-c01f-4831-a2b7-f1e488f3e924", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1d7ef0-ffa6-4642-9726-ce53dbcbd697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9627d49b-b7d7-4831-a8d0-c19b22797dcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d365253-de40-4818-b8a0-a0f19e867f4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ae73d6-38b2-4f0f-8b43-10bf84110bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35519b57-f15f-479b-a830-6343a7ac72cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db8f0738-dd66-47bb-9a05-f79cd187c455", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a61a43-f349-48ae-8695-90511ebbdc5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0eae4e-f0c0-42bd-b46a-9187a56060f8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.124.192.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd9961e5-b8d3-40f5-8fc0-c1771a527293", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.126.203.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843cde55-a40e-432c-a695-8c171940e1dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.126.219.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff79293-e0ae-4f99-aa80-8692485e6480", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.172.99.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bda593f5-3148-4436-98f4-8e051239d9d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.202.82.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e7cb482-91ae-45c0-b5a7-7f951e32286b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.31.132.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--029d5a14-6723-4478-a0c2-e59139924bba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.48.108.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4b94798-5be6-4cda-a233-035ec5ac44f5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.48.8.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b603ca8e-6c7a-4b83-bc30-402b7e70c08f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2021-31207. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.6.131.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31207", "external_id": "CVE-2021-31207"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9aa6e1cb-bc4b-4bea-8723-f32987cbee57", "relationship_type": "indicates", "source_ref": "indicator--b603ca8e-6c7a-4b83-bc30-402b7e70c08f", "target_ref": "vulnerability--9da2f1da-4258-4266-bd28-88d886934230", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1631742-b9fb-46e7-9966-3e002c0500bf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '145.255.190.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bf3beb8-8272-47bb-b9a2-b3fb89f4a29d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.174.162.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cbfc5ab-e531-45ce-8d2f-44b075217b76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.134.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea654cfc-ea70-4fe3-9c86-23fa73d9a6ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.240.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d0245d7-20f9-407d-9e64-243b85775746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.47.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85d49b3a-413f-4d22-bbf6-9f1ddfaaf6ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.57.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93c63fbe-665e-4d2f-bc91-f3928edf4252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.79.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e25831-2063-4990-aa74-45024c94fa4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06de6ef3-7de6-4240-b808-70c3557c2108", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bf15b76-21a4-4c66-9f87-c0cc57083c91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03be7c3d-b5d9-45b9-a65f-df7bbe4dcf6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c9816d-3e6b-4e8c-b8bb-78c3b7c204a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.52.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--127c72b4-039f-4e14-b475-6ce225b9f53a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.79.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc98f6f8-60ee-4a86-9573-fd8930d7c40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad2385d3-8815-4fcf-b390-f999b17d7a35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--697e8157-87d1-465c-9bb0-18a09cfb6357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60b85bc2-71ef-464f-a7f7-e32a7b28d685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.134.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85d765a3-89ec-4ace-bc6b-1b25126c6060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.150.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea7c82f3-0125-47c3-a229-ebd6593cef4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.171.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e64e413-021c-4173-988f-83afe97c8d3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.171.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd1ed626-56c5-4f4d-b919-ba3719b810de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.187.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c06b327-d672-4422-98b1-6678e381c7e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.197.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ab019ff-2ecb-4e6e-8ed6-5ec6479c443c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.214.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20b52a30-d778-4534-a387-f12b4d66dd60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd93b30-4fd1-45e0-b866-1c912a1ae210", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed14d5d0-0397-43f1-8142-1d57cf4e467a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51b3bb05-c0f8-41b1-be5a-e43dc7958836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362485aa-211c-4060-bec9-a20b89976e7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--446a0c1e-f2e6-4208-9f4f-3b9865527770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dd0c7fa-31a9-4b29-ba6f-51618d72302f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7ad8621-a157-492e-b789-e5045e7014ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f0e3fd-2d8c-4d64-9658-7b35861212bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b68f853-f527-4985-84ee-a69dd27c8108", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--379b14be-f6f7-45fb-81d5-9ef214dbb573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5acec222-c0b7-4f32-9430-2c1a7adfcec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2103ec17-aca6-489a-9ac0-51c44bd4f136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f56768-7515-4092-b26a-24c8860116bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a91d81-f3c7-4cfa-adc8-920796cd30f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59e9dbe-7a93-4c22-9a47-6983bfdbd579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04db5bbe-3919-4177-b96e-53cd7ded1b94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f82a80a-24aa-4edf-908f-804af89fa8d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--209021df-df6c-446a-9f4d-44273cb3bc34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1de97ef-0b9c-4796-a32e-78dc2f5d0ea0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c8302e-6950-408d-a648-c8986c1dc21e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c8d8e9-1119-4393-b7a2-a1c533c4383a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b921d01-cbb7-4c97-b46b-d8b8566b7c4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06e91349-79dd-4fe8-abde-e6bd6800ca5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394ad1a2-bccf-47db-8c49-c928a9d26ccc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c7ae9a8-96e0-47b1-a99e-6655dafecdce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a4096a-f3c3-46e5-8160-bf341aaf2df8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a88dc77-3d57-4a32-a466-053a0c6c82ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ace8756-4255-475a-a819-5db9fa961102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07da6a2d-d676-435f-a649-bd51f63f6918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8a7f6e4-52a0-4f31-9f5d-d74e057186b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e112fa82-b634-431d-86fb-eebaa134a43f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf810779-7cb5-4b76-8a1b-ef271240f386", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f268f239-94c2-4329-b984-63748911a958", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba43b19e-6ec1-4660-836e-7c49737f81f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81208802-ed18-4bb5-b27a-e70cfdb7bdc5", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fae839f2-0f8a-449b-b0e4-f70c9b64c64a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72771632-cc68-4379-b70d-fff1b8440d56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--973be874-0456-473f-8499-022c0ad4138b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--065c84fb-f7b1-43ff-b9e5-4a74171e49f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f9f2c6-9222-44aa-b6b0-833c6caa730a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca07826c-f980-4152-89a8-626b26ca1d1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71ac39a3-ede5-470e-9f6a-cd9ff636b754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad9d4d07-1d67-47cd-9678-f349e2269d22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a72784ea-5229-4c85-8ba1-cde359f1286c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1793e93d-234d-41a4-8fd3-3240351d669a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1163613d-2bdc-455e-a069-3e3fa224df98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a584369d-c3de-4aee-a8f5-ce020c627458", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--004807ff-5727-4ceb-a831-402dfd8fb308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a73141-bba6-45fd-bfe9-53d5366077e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a537ff-a8fd-4d1b-bff7-bd51ff04e94f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ff1569-6811-487e-adf9-c45b107e1be4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fa587db-82a2-4e79-bdef-f102edcb0139", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd69d03c-7221-4dd3-bcec-47dfff0bec49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4352d5ff-13fd-42c2-932a-d625cb135b17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4f0fddf-9eba-4a96-94fc-88bed7c99b5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8470e178-8049-4fa6-8fb5-fcabbb49b5c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97098bac-f852-45b3-a9e0-9a1a0643fdb1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SIP activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f03aee-03da-4284-843c-5659130dd2ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--784e3f74-c241-461c-82e6-b58d88fbdc78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--182d32d6-a054-40e8-a528-0a66a896fa39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecab157-8eca-42ed-adc4-35b388eabbef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b077f1c3-10fa-46fc-90a3-a8afd2f93c4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94c54c79-a34f-4d3f-b704-e13966dfea88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af55485f-0c04-411a-980f-dbdd0217d125", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7824ff8b-a17a-4be6-84c3-2229c9ccc730", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee82847b-73a2-4895-b99f-f509fa32eca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56691b96-0f99-4002-8657-61f70b7aaf61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da657285-f47a-4589-b96f-0d38224601b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42546a9f-413b-4495-aad5-14f8e039be43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9849bf1-07ac-4309-b55b-d53014afc9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b9f3240-2a63-4b5d-a79b-26ef19f1601d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3f32b0c-e144-4ffe-aeb5-1ff5aef0a518", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.255']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--457fc0c4-95a3-43c3-ad9f-071db9e54d2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6a06e3d-b726-442e-a54b-9149a254bc54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5691e136-d0e4-47a6-80f6-3f2876d1f588", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74df22c-4198-40cf-8fae-c5eddd8c7a2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a94c89aa-5502-4c79-85e2-16f9c32dfcba", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a67c48-4a85-4b42-8e44-d01586f40dd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9848fbaa-dd72-4052-8d53-bff068d26129", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c91b3b43-c683-4df6-ae78-fd4b986468cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b883ef4d-54f8-406d-a62d-32549acfaf98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--130b49d0-b708-4c40-9eb1-66a96ebbd444", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a39c0be-7daf-4839-9cf8-b13134770028", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd5ab9a6-5ace-49ec-b636-bdc823e49764", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7a5188-2943-4bbe-8b60-cc32d481f37f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2315f181-bbd6-490b-a2af-ae17dde21470", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25d44371-de1e-448c-a607-17d532882128", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ffc89ce-ce78-4afb-b9dc-03338e270897", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4321de85-cf01-4bbe-80b2-ecb8c217dcd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa75abab-b9b2-45a8-82f9-97244c2f8a5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6729bdff-947a-405f-8a48-ca216109690d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3aa1db3-454f-4e2f-a4f2-05b0b8adb2c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--826e0f7a-b843-4de5-986b-41ec62e51652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3265097a-f012-4667-bd27-08db1fbfe65e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d31761a-9744-4c23-a12f-65f127a79461", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--120e1547-351b-4960-8bd1-77f227aa09f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dadfd928-6278-41c6-adc2-c53cd16384ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45f46361-30ac-4bd9-927c-d8c3958cdb73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d131e0aa-b1b5-4bb8-8f6f-e46b6725ce56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df15d089-f990-4b67-a08e-0140589e24e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--224ce1ec-4bb0-4524-b3b4-4949b3713923", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78e6cf2e-c308-4180-a148-bead5b64e0f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eecf3f61-86cb-4740-856f-11839c31b397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b71755d-b637-4d92-981e-f9d19e58ed8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b8e7f5-b4fd-492c-ba92-8f12b6c124e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4e790d6-eefe-4c6d-95c0-6dad714048c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13b17a28-2fdc-4370-9e87-4ff693d3dc32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc697617-23c7-4198-b66b-487ea4d39d92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9dffc55-8392-42a0-b36e-35aed3f416b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01fe252a-6aea-4ccb-ae3f-89882bab1aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3461f90-6fea-4f97-ae31-a9f80ef57ec8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--840f6e5e-7b3c-41a0-923e-d3f4d5ed83ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--992d42d2-664e-4ce5-a2af-607613392ae4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49ea6f97-ac81-4e91-86ca-f37c58bc0da2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f83dd5f-7eff-478f-a58a-4229c039d11b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29155b3c-bc95-4284-87f7-3bb06e06c212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef662a6d-8655-4267-9de9-58694f3fba29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--206eec04-27f7-462c-8ede-0927037b5459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff3c899c-cae4-4b9f-beb1-09c7552a3eec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e2951a-5793-4ec1-86cb-36d7d035520b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ad4b75c-a1fd-4b67-b78f-a04440431b7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b505591-1e0b-4ba4-bee3-a0089deed010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4700f39-f9a8-4ff5-a792-a946c0c28712", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98225589-b508-4e33-addb-13e2b6cb172b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db30180-0b0d-475b-9c14-0f42697deef7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92e977df-bc62-47a9-b75b-ca53fcda6a01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db8a3c2e-ff4f-41d2-a30c-85c7f0adc2bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc644c3-526f-46eb-bd07-6fcd6911e193", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bdbdcad-9455-438f-bd7f-c887ee043861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e6c037-1f90-4e9b-9468-213e24c7f9c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58796cb6-fbc6-457c-ba0f-79dd45c509ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f22dc6bb-e70c-4aef-ab53-9e85aebf70fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76370797-a59d-40a9-87c8-53d6cb518226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b44e11-795c-4b5b-ae90-56d1b48e5e35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eebe465d-1442-4e50-8f2e-cfc5dac344fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732535b6-9709-4a01-87fa-fc0376aaf9e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--701bb6ad-53c1-4adf-9c24-b0e1d7a19c9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f92bb77-c1a5-4bfa-a0ae-5e9894952df3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eda8334-fc6d-47af-ba8a-4783a04c847a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3893cb8-deb0-4899-a28c-f2c79e473bcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7119619-4cd0-4dae-aed7-65a255b48b76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71d01f4-bd7d-429d-a3dd-26cfe50dc0e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ce40fdc-35aa-4590-a8e7-c0c3f53f764a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98a333ca-2aea-4a83-86bc-7b674fd9bde4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb40bc6f-8ec4-456f-ab89-2d48c756bf01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1baca231-b83f-43ac-9756-2bf8a72b94bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb0e6da-82a3-4f04-8958-b940514d4630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b38ede7d-2d62-4053-af44-1401e9acd48a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e71f1965-7952-4cd7-8867-b9a2e839f902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0a630a2-1094-43ce-b73e-2e60971da4ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a457b534-9fa2-4f6e-9f14-595b85d8bb15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16761f78-3c45-4c5b-a277-acbd387b39b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5688b545-7e90-4f14-a2a0-b135504ab97e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f33544-7fe2-42d6-8904-d65952505d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05b59d8e-92aa-460c-aae3-5e477b1a904e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ed6fcd-b1e3-4726-958e-24fdc8d73ed4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45cae13f-3080-4472-b493-768fd8a5a887", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9180b94-fdd2-4bf6-a2c7-1306e6abbe6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24024e78-ab03-4762-8b37-58f24ce0c777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5e42091-118d-4547-b5bc-05fa05011ef1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4072841c-2e59-4e2b-ae7c-6ae7ce327eb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e101669-60e6-47af-8fc4-0d392a874bf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b23ec0-b132-4399-946b-06faf787ed38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cafbe4a-38cc-4c11-8124-c9e9b1a0cf3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12989d7a-b850-4a6a-a128-176f38e30a43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afb1b6a6-310c-467e-b6ab-0ad9d087cbab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04500178-c13b-4609-803a-4ce999377d9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e72e47d-489d-4c57-a384-5bb210eccc7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01765d49-2870-4be3-8889-271c568b3eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48806c5c-ae26-43f4-997e-83f5c27659db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7d99bca-0370-42d6-a4ac-6af27cd86565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb14d129-9763-4986-988c-5e2662e0ddbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--702ad605-c4f4-49b0-8860-527d87f87ffa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdbe10a7-605f-47bd-bd60-14ff27a14910", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e2fa97-60a3-4689-b728-b718290af738", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8f67b0f-6a42-48af-8a41-40106aedb0f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--691b3a31-c5a0-4a9e-b40b-e5ffa4d3a87e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b957d17-470e-49a0-98ad-651cf1b5d944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d9c326c-807e-456b-ba4b-5fe7eb472261", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab4b75e-651d-4b8c-8791-71e75f766f57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--345e01c1-04c4-49d7-9d42-f3037bea00ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3cf2dc0-3cff-4215-9644-dd3eee621de1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04adfd62-79e3-4121-8555-6cf77fb8bc9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890670a6-ed2e-430d-a108-7f3418c23af6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f5f5f5-7a41-4b20-b74c-f11d08d8fc18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369b6ec6-efae-4b52-bfcc-315bf06a1acb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18eb316-e015-4a3c-a845-87a6c6ed2fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f755f54-4523-4b0d-8444-5ba2af2a45fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f21ce17-af80-4575-8941-6c3a43b65a6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c39060-d007-467a-8b79-3a3eaecb412c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d377b89a-17e0-45a8-88d5-e144a0e5f07d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d30775-da2f-437a-8ac7-7d34d21e83ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.234.73.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--851843c3-e3b2-4d35-9b63-da47d73630a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.235.144.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--184f22bc-531f-4098-82f4-5d576f33a881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.45.50.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7886b18b-c9a5-44b5-9415-c3a8aaf2c1d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.122.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57cd317d-cce0-45b6-bec4-32855772c39b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.33.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc8778b-6563-42a3-bcb3-7c8959fb444d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.49.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc4e986-5129-417f-96d8-772f07622614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.135.70.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--649b7371-20c9-4b20-91bb-766f006036cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13f2bc5c-27dc-4e93-8081-5d7247626a2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f13d2c7-ebbb-4a66-b0c1-fbef568db7c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.184.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b440f6b1-454c-4d51-9ae2-2a0f7922521b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.184.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f662656c-9df9-4b55-87dc-e25ba7b8d9da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.245.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7750c4e-6555-4038-9472-af8bfd6ea234", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25054994-eeb5-4ea8-a36c-f935c5369455", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec31552-3668-4f0e-988e-684bcdff840b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.66.90.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ffad1b2-3bb3-49b8-b208-4a61e328bb47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.54.24.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe1a3704-6d7c-478a-b473-7b60365e98e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.56.241.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4df900c-3ac3-40cc-be0e-9cf2b9220126", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.157.135.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5dd8848-c2c1-4199-9408-54718e739719", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.150.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71982165-71ef-4124-8ff9-321add574cd9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.157.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--849a2119-5f3e-4e87-a97c-633b039ca43b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.235.104.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ad6ca03-9972-4e0b-af44-081c6dd668c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.236.40.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7312a10-80b1-4c96-8fdb-b5d9a327ce90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a481e31-f4f4-4b02-9069-d9f5ed93c319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb8b8d28-1835-4f1d-b4ba-2dd71967486d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1261a371-e9b8-47ea-954c-35ec51071c27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9567d8c-1707-437d-94d2-fdaaeb53c5ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af8d857-1546-4199-b1d7-f9a487f7f816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dbf9a58-adaf-4fd6-96db-c47b1256cfac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5fc00f8-1fd1-408a-b608-fbeabbd1d186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed25618-89cc-4c08-b404-e6bfaa0173ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59b4d2c-43d7-4e92-8568-5184cd9c11d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--005e177c-6b5e-499d-8725-27e66699374f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7305529c-8cf1-4b1c-a623-16356be64409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b140cb68-2110-4a92-b99c-77cf6762fc37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f80d6d5-66ba-49db-bbbd-290e3e13f2fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ff381b0-8dab-4014-8114-ee6b960c6801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eee05b9-5d28-490c-9e55-454c9e9dcacb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e7bf57f-5c98-4067-a92e-4d40f5332489", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e42caa6b-b633-46ea-b007-af967cf81710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa495049-6c18-4bf1-b610-2aa8b3f6632b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a50d0203-534d-40ae-812e-540c3dcacb93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--613c004f-08e3-497f-8f72-3ca0180df4d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5030306d-f0f7-42af-99af-86f502b6c214", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37386a98-1b84-4c6e-be17-d77f6cfbadae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a4ba885-bfb8-4f4f-918a-5ab7842a377f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65d0e282-48fc-43bd-9585-43c9a9aa849e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39a1e11-0179-4c98-82d8-0e1e0e85dc26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec1b6a64-5f9d-44df-b53f-61dd9a61cf5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bf22251-f5db-4722-9ee0-f89ba94630e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b100b7ed-8432-4b8c-a596-291d06996969", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263418d5-b5a0-4a79-8335-c0ee9eb3e5aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac45d70-a0c2-4c4b-98c4-f9f68e0c8cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30b241b3-04b6-49c9-b0b2-1cb061457bdb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.10.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6b2b79-0675-41be-aad0-988128e60f1c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.10.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ea1cd9f-dca5-4d16-bfe2-fffd575d6cc5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.20.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31ade283-ed6e-4fab-bf96-68921b0336ff", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.20.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad0c1e9b-088e-48d3-a64e-2da1f30a8e13", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.6.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--406a8097-55e4-4016-b592-34ae24e1b2ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dbef670-784a-4095-b5eb-cbb87bd343b9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.242.191.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50016804-abb8-4b07-99a3-3b2db5fa04f4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.237.23.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4237ffc-7a63-4ffa-a288-4e1cb9286fe9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.244.200.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbd5e0d7-211e-415e-9568-bc5d24c6ed19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.250.143.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35040d9a-9643-47c4-a9b7-74d7894b996a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.250.40.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09be2e6a-ba8a-46cf-b8b6-aa68c022f872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee1b919e-71a2-419d-84a0-a534d72a400c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f779444-07db-4d9a-babc-32349577ed1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.129.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d7fec92-9393-4f37-a7ca-db49a79af25d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.129.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f12727-6292-446f-b352-4543aca8a763", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.130.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b78ef29-e9bb-40b7-b665-e046a4ccb89e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.132.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec14ece0-6595-4d41-8f9b-1945ab1c9084", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.133.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--425fcaf1-b6ee-45bd-8373-962147ad730d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.134.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e49b429e-89b5-45f0-ab4d-3fd1becdc5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c6fc90-d6ac-4d36-b7d6-8eb39a309784", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.138.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17830775-74a6-4253-a74c-4a19cd86049e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c3fc660-d5aa-41c5-9ef3-67dbe3da5b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83af0fa7-5073-4dec-b782-20645b382cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24042b52-91ca-414b-99d4-62de37e2a5d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d116b84-53f9-4694-b619-6c232698dd4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03c2af28-03f8-4748-977a-65692e7c0657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cee16ac-f5ef-465d-b314-2822e36751e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.143.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--027c6c08-8ae3-4467-bb79-cdf598c67aca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.143.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e35e66fe-ae7d-48fa-870e-79308447a903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.146.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49ed25d5-2194-47fd-ab3d-a9bae63f0182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.147.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c720d03e-f929-44c1-8959-d80db9661cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e8e64be-5a04-414b-800b-40bb9a1bb62e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de2ecdd7-a7b7-407f-b3fd-91fa06b99f94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03d47908-1616-4392-934f-3d57abf341e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2040b1f9-1a57-4901-8432-4fb9e3ba57a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffc1dac9-5397-4e9c-bc5f-181c9a26a224", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.153.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ac66ed-7278-4036-9f7c-fd48829503df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bf6414a-bbda-4ce6-b75b-ed1aef90ae99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79eb876a-b20f-4845-8174-7b584b71a182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240d07e1-225d-4404-a814-7bb8ff8d6f56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ff0c90-f3c8-4714-bc41-143d2421420a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6682889-d544-4f67-80b7-7444099104e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.169.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0039da4a-0f1d-4d8a-88f2-e59a2f5a65cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.170.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--070437ab-b986-45c9-99c1-e1194e0e81cd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.174.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ad47c86-44fc-4fbf-b48e-acae552ad5ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.176.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1364c833-af60-41df-a4a4-15a064075cf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--781b65c0-c85e-4d52-9d92-74bbcc6e1b60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be6f6f8-b799-4722-91d5-fffd5c27ac5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a430ab84-d583-46d1-8897-bbdf1788a0ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14e6ea0-9917-4690-8078-cfbce29ebc45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f46349-6c6b-4d21-9a43-1f631d92e14a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.188.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69ee7616-9a7d-4cc4-be13-8461676c6052", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.191.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adf90e35-b255-44f5-9dce-2cb4e2ec3cbd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.192.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0323be3-469e-4357-95f2-021343dcb181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5823c35d-716b-49f4-9308-4fa21c5a5c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.198.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e9da44-0716-4740-994d-ebf61c97a8bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27724994-29dc-48ae-8657-3729c6210238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d2eb533-a27d-4752-8064-f5e1e57f3383", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c3e95c8-92aa-45b0-aacb-467a1c8a8c20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f719997b-7f3a-405b-be6c-6432589bbac1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9e9a384-ab29-44bd-90dd-8f883f14519d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7914d932-6a50-4ae9-8eb8-b646b51d889c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.203.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82bc2302-5c25-4443-b155-6338a449760a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--981365ec-f296-406c-8766-392d9e0bc190", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75bd1694-2b97-4759-9f70-851a4e9c2045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd00247-641a-4246-bdf9-1670c295ebde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3930a76-b8dd-43f2-aea9-90f9b8b9271f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e424c2d8-256f-4d47-8f8f-161dff22a2c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90917e94-f24c-4aa4-87bd-3dc83632367d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83f54c1e-0ae0-4680-8766-5fda1b3e2c1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40212981-7b83-4eb4-bd97-bb786125aede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b2cb6e6-ae04-419c-b9b6-e72ffbfa87dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5741ce02-d05e-4952-baa4-28dd1b6ed611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aad6e751-59bb-4e2a-a54c-3e52fe2f39bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e166c825-49b9-4ce3-9d33-ce0898e10dc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8011b321-8bff-4e49-8b8c-99b8386b0868", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74a3bc9-dcc5-4582-a43b-0bb5e97d1538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.213.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cc35c73-3860-4649-ab0b-57caf93fb20f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b88790-5938-4221-bfb7-d1e536404211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63708f6b-814c-4d23-b6b3-165327cb8e81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.217.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65ca8d0-d7bb-401e-8fd7-8b047db60aa3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.218.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ca6aa66-301a-41dc-b8da-21e207423ec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.218.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--112520ec-b216-4420-bf3a-7e7fa8559a2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668c26b5-02b0-4373-886a-7b7f05ddb07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c3cf03-6ec4-4ff2-a98c-ad94a8ee4dc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--405a3729-c41b-4176-8152-f96246d7bf34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca885dab-d2b7-4dda-8ca9-457526968c87", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7809cc9-9d13-4d4e-9d8c-ef8c2e99164d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa975d0f-d0d7-43c0-929d-5186272fc085", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f6b8e0-7dc1-4f2b-a6d0-7dd4c3c52202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8d838f9-a288-45b6-a605-a8bb91cbf37b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a82a48-e71d-4a65-8bfc-8dbe87f4be8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.228.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0f297b9-70dd-4624-81a0-15dee4592d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b13283ab-6bfe-4bde-aada-0d1db1876238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--880ac684-a80f-4f63-b73a-606da781ad4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f401bedd-19d9-4eba-8250-16d655fb21a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d846f964-3465-46e2-9113-45e52c954ea6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9524867-8719-4f23-8c43-dd63c6c6b5ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93188407-f586-4cfa-b4fe-3dd588816842", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f60b784-297a-4660-99ba-a16a437d3a5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57939675-c347-4b2f-868d-25e2057b996b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcab8268-c2bf-451d-87b0-e6f9e441c69c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c9b287-feb4-4375-9cd6-94d1a3dedbe8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.238.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e31ccc2-d336-4afc-bfbc-3fefffef8a1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.239.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b59e6b-499c-4b02-aac9-1f27c24cff78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.243.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ff7ada-9ee8-4392-9449-d01422ebb213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9369696c-2f35-4699-9a34-b52c9b8b752c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca2de76-ff2e-4eaa-bf78-9b945a143f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.250.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3652924-7da6-48ef-9c9a-6d51bb8eb1d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.250.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b76ee372-d0a5-4ba1-8b50-8581fe3aead7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.251.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d935f821-4d7a-4ec4-9ace-208bcf1f5ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dccbad7-1e4f-48e3-b425-399995353f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.134.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b621ea52-4d66-41b1-988f-a83f8fb37d03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.140.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9efd717-5757-4f2a-8eaf-811f4407c846", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.218.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11e2659-9084-497f-bc52-81ff25e2afad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.191.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ae965e9-a55d-4883-8b65-0c8a60f4ab43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.22.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebae73db-f075-4332-a3a5-d56270eead3c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.99.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf5f682-92ff-4e1d-a011-0a0575f8c9ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.56.144.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1035a57-3625-478c-9a11-06db93146f1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.59.83.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--123df22b-47ff-489e-baa6-add3d66e3869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.197.55.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d47502-0c4c-4067-b824-dd99070e4681", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.0.30.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b800d5ee-89ac-4772-b558-a91055b28b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.115.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--098f7a3e-0c71-4e6c-b17e-496e7fc861ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.115.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f426ba86-c0bb-4c5d-9af2-cfcff8873cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.119.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--805de21e-3f53-4bf4-9ecb-01d63f2f358f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.180.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a5aa8d1-caf1-4d81-9055-7c5e8e8cc3d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b14441-ad41-4ba4-a754-4a671944ed5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a2cd7c-ced9-489a-9d26-68a77340e7e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2020f53d-614b-4ac2-8a6a-70149cfa9564", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6beae9d0-68c9-43b5-867a-983030dc101f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.221.28.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bdc804a-dcc7-4c74-9ec5-183f09dfecce", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.61.72.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97aa1704-533d-4baf-ac82-e9e0e0d9899f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.81.14.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5101d58-d456-493f-bdc8-755bbdd90c3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46609a1a-219b-4dcf-9335-e30e537ca0c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a2c92ce-a1d6-411d-b337-30eb93d582c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e252e079-ea04-4279-be53-b1014fdb4b1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f12faaa-0f36-40ec-abad-264b0c4ca065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12794e38-4635-4a72-b960-7f8952fc15b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091b51bc-5006-41b6-891e-83cf60320bc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a211b1-a504-4d3b-ad76-1a48aec61baa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d109d7cb-48a2-46bf-9eb1-98f8f0a51414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f246c2-c46c-40e0-ab90-4c4b22942184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692213b2-fde7-42b2-8d0e-3550472fd7e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c35dbe09-f31f-4b05-857b-27587f68f37a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--864e5d28-d378-4f96-bd29-2fbf7a0daa35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42634b8d-7a1a-48bd-ab19-8cc89a2753fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af479bb9-2186-4d4e-a48c-e6bc0ee8a0f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf45aba-e783-4191-80fb-80ceb03bd1ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d766ffa9-542d-4c84-8394-5085543d2b86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59142ac5-42ff-4868-ac44-d8551d242456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765eba35-929d-45b4-96c8-bd3e757f4d01", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.245.207.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--334d595d-7e45-4770-b282-e7d4a8c247b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.59.197.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e600a14d-2c48-4b33-b99c-2fea1fe0c1e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.10.198.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b843ecdd-4f9d-4b29-b206-f55dc3cd2ad4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.173.107.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e29072e-c78d-44fc-b152-89c3179b2031", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.154.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10dd6753-43d9-4a37-87ae-44817f8b0e9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.178.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aaffa78-c95b-4210-b018-d4d270b4195b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.4.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f14b7557-82da-4f64-8187-0762e3ce2449", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.99.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d118126-ed2b-4c3c-a4fe-76bddd16525f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.111.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1da6f856-71ca-4d06-b59c-6f4ed67f5b5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.68.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80240fd9-487b-4b89-8fc5-f986adaf2ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.8.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53c0b28d-55eb-4934-b0e5-fce08cef934a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.86.255']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77efad9c-82e3-406f-91be-1bfe97c40f74", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.55.39.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e0935f3-cc7f-4d5d-b51e-a177b22934d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.94.211.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6e22157-3458-4cec-b5ab-7d1ac96556fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.13.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03db3da5-cd3a-4236-8894-f6c50bcb0fff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.18.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--725fac81-0608-4117-81c8-71bcc94db6cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.183.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bfc088f-4afe-4e15-877d-7998d5499616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.25.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fda5a00b-f4cf-43c5-9a64-0fd1291c03c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.79.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e86da0-1dda-45d7-a5ba-8142488d911a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.125.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e33dc7f-3709-453c-8b93-c453bfaf6cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.148.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3198edbe-7735-4b7b-83dd-ee7ef7ff2644", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.151.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19cdcdc-f3c3-4600-b71b-6da812c5ec45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.159.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8faae79c-27d0-4ef5-89c8-1f0c48e478a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.171.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49296c74-04bd-4daf-bb6f-8ae1e901cb94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.96.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3975455-c017-49be-b52a-7d302da65fad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.108.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dd70f0c-819b-408e-b6ef-ffb507511b12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.145.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eebf057-5fc0-4c05-880c-4b6760b43bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.158.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e05bf7e-4854-4666-89d4-d6e870a5c13f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.168.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1827c44-d62b-4662-91e6-c83e4247a035", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.191.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f738fc77-44b6-4e74-8135-5739d650426e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.232.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e060d6ce-d0e0-4870-82bb-46af8707774a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.54.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ebe00a2-c09b-4160-a7fa-19f97644adc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.118.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1417a48d-39b8-493a-9114-05b4daa88f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.123.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99d7bae6-0399-4b28-b9d4-445c3d8f7852", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.236.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cfdb714-83ca-4a75-9ec4-471c7988aa92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.28.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d1c43c7-c62a-4ce7-a91e-94f460544225", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.47.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d0795d-b7aa-4763-95e3-0ada4714bfbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.58.56.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b172087f-8847-4a10-8077-066fb63488a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63da1403-935d-412a-aae3-1cfb10c5054f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.71.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba2d5ad7-ceb0-4959-b442-461785d79081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.71.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96b5a199-e3a4-4170-b17a-4142c122911f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40cb7bfa-143a-466e-a3d2-1393dcf59fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--114fbb80-da32-4103-8aa2-d8c3e86b1d48", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.187.147.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e28aebd-5618-465a-bc2d-0a85190944d9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.187.54.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bc1cc34-9a1f-4c58-82ce-d32be73648f3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.191.54.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70f69b85-9d7f-4886-9cb8-58b6e59a2325", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.238.24.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--318b02f0-11bf-4b67-8089-4f7fad33d67b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.250.186.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--053cb58a-ebfb-43ee-af64-b9e41b1dedbc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.248.189.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb477f8d-7d6b-4e59-a6f7-b920c6ab3d44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.147.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c13477-78ed-4a6d-beb0-35362be1fc68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.190.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a15c0b51-8182-466f-a5a9-79e2d6914cc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.209.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d3a1464-403f-4ae8-94cc-8450ef986f49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.5.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4d2069-153e-46d3-ad84-e436404f2104", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.53.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9765245-0941-44c0-bf02-a1ae1ad9b17c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.97.129.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d280688-aa0b-48ce-88c3-ad4599d7ef6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.97.69.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c03411-3580-4fe8-8add-21c555e3dbda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b13e89ea-e9ed-45d0-a9b2-008494f4cb4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5c85990-3102-4aa3-9a84-22583359cd66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac2f83e4-be8a-48cd-a38e-ed961cf4231a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eb89606-d902-43a0-849a-0f64755009b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc98e37d-6a2c-46ed-af5d-be10cb11da46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16dbf4c8-ba65-4f75-9fe6-84ba905a2c45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea84f678-d87e-4fdd-ae0d-07343684d32b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--663026de-0168-4810-b0bb-6c655d13188d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d14ace10-935a-4b2a-88d2-69d9313d48ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b35e5896-91e5-4b26-82b4-9632e6a0a10e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b4aab2d-0032-448e-b598-d356ca1db3b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--063d7492-d645-4392-824e-e838d23fb5c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--679e6fcb-1102-488e-baf3-c88b83bd4d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0529c063-9171-4258-9fd3-7f7783f84331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b93ccb92-98f8-42fc-810d-22f1eb1b100b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e47a981b-0ef9-4720-9411-1f435100e3b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c89a3736-1d48-4949-b38a-b74a67a6e079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf0b1f0c-430b-422e-9bd7-0ab19dccd435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3bb26d4-908a-4fd3-b6ec-def01acb4657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85beefde-0bd6-4af5-b03f-e2b9f6bf8271", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e0f1b9d-c9a9-4bf6-971b-4566371081ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08251877-3160-4afd-bdaf-4f5b5f4d8dab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80792d65-bd11-4cd8-8e58-773d7781b884", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb8b0b4-369d-4094-9a59-7a2a48d9efea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fb948f-7f7e-401c-b3df-93b1960ae139", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08c9a934-4dee-448d-b24c-8600657028a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--088935c8-2d78-4727-8061-06c96f96edbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69211e51-c41f-4945-8538-b1f4640930b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac4abde-dcf2-4817-8170-74bc3bd1e488", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a812f1dc-a0f2-47fc-a003-253c6515134c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3799cf-0084-4d5b-943e-8e3f301ce6d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--492bff5f-847c-41a9-bd9c-ed89e621a976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4878620b-2e5a-4ea9-aee1-c8f15f74bfb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18fb95cb-f084-40ce-9a83-99e526881beb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c353db9-8e8c-482c-86db-a9f4198de778", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--554434b0-6212-4483-8f2a-0ab655219416", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75669c95-14f8-4299-83a4-85a30d0c8c2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91d8c69a-a2d7-439c-a7ad-e1da249b7a0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237b6c70-14a0-46ae-bf3d-538f8eae9f97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9725b27f-8839-43fb-ae40-88a2e87dec19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66308229-ea97-483c-8436-927627d1b6ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a128b98-93f7-470f-bb7c-46d5795624e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8817d205-d67f-4cfd-a2e0-690d3118bbd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8e19ff9-ec32-4c89-9b11-6c2bfefd7494", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939e6c65-1901-445b-9251-2b5b0b656a02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49d9594a-b41c-4d1b-aeb8-7b8c279a821c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b22b93-80ac-4dbe-92fa-1c1688022cb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1b7279e-0f26-4e29-9611-d1d83c2d831b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78871df-8a5e-4271-9b48-c779d58d1252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5db0f78-6441-476a-ad90-a4431ff5a529", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--970e320a-54e0-4190-afad-73b5c3ce648b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ea683d5-5e45-4b7c-a4cb-404eb6f19fc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ce2e09-d062-421d-8907-072880d58ce7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b6c6dcd-9f6c-4c00-ac77-4768b178db22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf816106-766d-4d52-8dda-67483570a2e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6627a7da-5427-49bc-a685-28366c219896", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e94e79b6-ff93-4569-9649-40cf198e6fff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7361804-15ef-48e9-b567-4ea6fc8a45d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e92d145c-72bd-45be-a18e-ede773cbd1a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e373f46-f4ff-430c-9d0d-562950a7ceae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cfff31f-fcea-46d4-a2d5-0577e744adff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--921e8bfb-cabd-4472-a53c-75e96eadb9ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec90014f-c3a5-4a9c-a035-31d5dc85ddc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52f35cb3-c480-4066-a70f-bf8f2117ff54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--474d0997-55b3-4fee-8c06-a51c6530714a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efd215fa-6ed0-4947-9398-ae09d9765cd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9574797d-02cf-4ede-b85a-89548e2bade2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4371a98c-a105-4751-8f69-3a5f6f6fe1f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5387f377-5b77-4d6b-b2ad-24f0cd34ef6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c2d106-4b09-4779-9582-01a826906bf6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a967ec9-a365-4ef2-a3d4-df21c09b11ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07095547-99dc-4b68-a493-4f194a633427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5091dc7d-161a-4fbc-9441-0ba8f95320bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7118ff8-4dc3-48ac-b9c4-5df5fdb63837", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a56f97b8-fac0-48e7-922e-eb344a23dc54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d58d9da-1ed5-45da-9363-cc2327abca33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54193180-b290-45a4-855d-67097d9dc143", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcf9af7c-d52a-47e1-bfbf-6269a5c2cc2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63f08cf9-8965-4a87-ab21-e61c429f27c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba2b4556-7a78-49eb-a941-762bf48de944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b75d444-e661-4e75-9248-27d984f7dfe9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8dc0ac5-85fe-47b2-92d9-a06317be7b8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd5076df-bddb-4320-bd33-96840c8d1b0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d2b6d15-34c3-43df-ab48-86632e19a1aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27104ac4-e66a-4df9-a374-7c28454abdda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcdbd6b9-2da8-44ff-8b83-04127aaa5927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15494ba0-de8a-466a-b0f0-7ea941d9ca75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50faa63f-b8ae-4977-9d9b-7a924e3060db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34e582cb-ff8a-46e7-84ad-983eec7dc49a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f940554-ab57-40cc-853f-7343e7ff3399", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a815999-c247-48c4-83a0-c0d1bce5dbe4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78ffb079-ea43-433e-99d7-173680f246e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d79495c-f314-4561-b849-0b4c5bc74fe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c82ca90f-675c-4713-8e7c-0d73adc122b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81bb6f7e-6078-4f28-9342-68239cc338f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9667b587-f3f0-4e82-9526-1babfab70925", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91f85213-dbec-4c55-976b-1bcd9a4adeae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c4a9d65-238b-4380-a47d-ba819d5668a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4063b88-b178-4617-9125-9b3d821725c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8501491b-7e72-4f3f-932a-b9447d517a7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb35488-666b-4717-b488-7fd1159eb114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700dae45-da31-4719-aeea-fd1e18f23cfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd49fc7a-d96a-4257-9c8c-928bd546d356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b924dc8-49a5-4644-a283-c8c9fba22380", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce011ba8-9cc2-4b13-9555-0e4bc4c1779f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308fd7d2-36f9-46ce-b66b-36348954078f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb13314-3b63-46ed-ba7e-3c0b973792ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a591082-ca5c-44d2-8fc6-5c60a4db48d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b83eabce-888a-4381-b199-14253092418d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af34cb2-e87c-4658-9508-7c77b8bec18b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92afa932-b174-4c22-b94e-75c8150f61eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0fbc85e-57b2-4639-9930-88486a91cfd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e005252e-f4d1-4fdb-8cc6-e21286478072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9652fdda-e789-4609-8f35-c943ca29b38e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8832b80f-9c64-4158-8875-98e212b40174", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e02c676-765c-44bf-838a-9643665f4d9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--957d1d1c-e461-4cbe-a613-ee9e09074b72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513900a1-ffa1-45ae-a52f-0bbc9bda3011", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da57c663-66ba-4b37-8bb9-26e76a8e3871", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08253901-ef78-4278-8fe6-9c66f011a47e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3e4bb0-da78-4b2a-9f5b-1e3d80ffa082", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34a795a1-ead6-4ae1-973c-e40f7e5b139a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ed75d2-c053-4e97-9c95-ba758bb65936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f602e03-129c-42eb-8759-56c2a81712d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dccadca1-436f-4076-8be1-5fac8b90c661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5204d3bb-1c28-466b-80ea-2818fe6852ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c42ccdf-eadd-40f3-b7bb-eb9285b4faac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--291203f2-02da-40f7-8a54-7e3b17a52e9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57f6e17b-c935-41d8-9a22-0031f10ceefd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eff81bb-89bf-4db2-8c1b-25d547385e78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7454428-5579-4ce8-8395-9172187f9dea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27c6a5f2-fa0f-41a5-9fb3-c823d3246abd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec07c641-e2ea-40e7-8289-e53e2eb6b6ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd0cd65c-86d0-4ec9-af48-0c611dcdf739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be3fc36e-03dd-4baa-a336-aa99cc11f65c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--651c7a9e-525e-4bff-8982-9e3c8b786b30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779c8568-d5e6-4257-b260-732feb076dfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3415618-fea0-4c6f-9c81-bfd76382205a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--419a4e76-3e7b-4673-a966-ba66e3009882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31627d30-201a-4c38-8ecd-a5ab62f9cbc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803d9a35-4818-4372-91ec-facea029da6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5915ac9e-48c6-48d8-a02e-2ec573af9bbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2f225d4-6645-4b65-a6c6-46bf8dd42a94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ebfa27-1381-438e-9b93-616d121e6f99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab9c6f6-3f8e-4239-bc84-9672dad1e67e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--296efee5-cdca-406a-a211-edee88f775a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54ff3165-f259-4fa1-b461-c131aabdc68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfed9bbb-7c24-4d85-8c54-4fcd1b4d6469", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c99d4af-cc6a-4dd5-8734-e12e7b41ff17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd3cd0f-ff2d-412e-9b6d-cf63b0e1d118", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a98bac-ad67-4d4d-b561-8c01e0618d44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b5aa8a-e263-44aa-bdf9-79e95844e06c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86001c56-d7f7-4242-bb46-4cba2b2ecaeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6ae1a7-f865-454f-abfc-69684a38c0ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5333d83-a377-4357-841a-13583659b120", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50edcbbf-63d5-4822-8db9-ecbbe0687dca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8ace709-16b3-4c6d-9ab3-417c3e4ea0de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43b7f3b5-ae5e-4727-b401-4a8df5c6f667", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4624e17-0573-4214-8585-0df54f3cc642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064d4fa1-162a-4f24-be6d-bf01522afbae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f85c44-8d8b-41f4-a33e-d4545c24295c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e7679d-a17d-4779-b002-427ede85bdc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81c2bce1-0ce1-45e5-b2ef-be63a5071308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b5723d-00ee-487e-b5b9-71e11f8c43fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cae6d840-f4b8-44ba-beeb-7ebbb280998d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62eacae7-1e5c-4f27-acd8-191712ca56d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002dfef7-84f4-46c6-87a5-30e1802da46b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a050021-8989-44cc-b658-0a70b79bd93e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edda5aec-e0f2-411d-87b3-0ffaaff92ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c2872a-ec50-44a7-85a5-20eea0159b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef3a22f-6002-43c0-b405-08945f07b8c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ecf61a-3068-42a2-aa01-3959274c0b12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a38a0603-30cf-43d7-8787-d3039445a0e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fbc872c-76ca-4d9b-8c2f-c53177d5c716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fd407a9-9ad2-4190-ba02-33ee4e471006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ed00b6a-1c1d-4311-acb5-ed5a22409f19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a201f7a4-e43b-4ca9-8236-0f3724a4fe98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eb65f9d-efe2-4ad4-8988-fa0c7eba6a7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61407d8b-2569-4f53-bde9-be4722812844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad3d069-85c0-45d9-8906-a90f9200baa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9533234-7fa7-4942-8ae7-b3e2bfbfbde0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.18.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cbdbb42-fa80-495b-bee0-d9e753bbe57d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.168.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6575d3da-8c4b-46b3-827b-007046cf3abf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.245.191.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b534eee-9617-4fa0-a7cd-959c4f71e38e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.231.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c0802dd-9dd3-4034-9be2-cbf475adccdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.245.204.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4244591a-58ac-44de-849a-61203859d021", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.24.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5584ea17-abcd-460f-bc18-e018aabc7439", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.138.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9160526-822b-41c0-b5b1-e15297c74c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.151.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3dccc6e-5796-4e24-8dbf-2bb214f967eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.156.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c54d3188-9a3f-4ea8-84f1-d17e73ffdec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.159.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc9f8bef-9fa4-4c50-ad3f-802a04d6ea1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.195.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6bbc641-ffd9-4cf5-92ef-1f69d61414b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.138.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fab61874-572e-4797-8e72-6cc8886ad320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.224.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87729b82-fcf3-459c-ac55-cb2038f9ec56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.228.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a99c2c1e-338a-4cbc-be26-fe4e90c92a82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.0.139.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c7fb0c2-87dd-4362-b998-23a30cb98e6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3f4d21e-2589-4691-9714-5771d2d98900", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b710e0f6-a17e-4098-a75a-7c7771659859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.100.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b72b3777-a46f-4861-8849-06a98db09cad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.100.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71fe5f4b-4ae8-4832-92d8-9665100b0a02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45397d56-f4b5-4721-89b3-08609cc0bae3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--395e3d19-0b9a-4ccf-b476-6c878aba73e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.118.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78a9f292-ceaf-40cd-8605-fbfd09354061", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.119.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb838c3-4a2a-464f-924e-717caaa75ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3add87c7-1fe2-4802-8336-7f5196904e87", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab77467-780f-4429-b9ae-7be31932480d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b45a4f3-a3b0-45bb-8470-6f135cfc35d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea6233ab-7960-41b8-bb51-907b1f3769b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.128.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c7d485-0c51-4ec8-a66a-76b15216b36c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e6c8886-96bb-40bc-9450-ae5d6651bd6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521c685c-663d-4132-8cbc-f53151cb4ae1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6305ab09-7223-4ea4-8bac-710994c77c5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e04d898-0135-43ba-a6f1-0653b5025dd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3ef458-17f8-4188-8699-54f7b95b8a90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2515ae17-2475-481d-80ca-e39b153e340c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99ecf5ea-0c7d-4485-aa30-d50d87d8efab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49107313-d04f-45a1-a242-8b47c1c559d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebd9138a-5b2d-40a2-a286-ec3701b4fd5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--902ec467-4f5e-4bf2-81a0-242c4d7bc143", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8d94754-9b0e-44c3-8172-7d3205024e65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79a63fd3-8682-4314-a048-14275528fd5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b230055e-1858-4e1d-be26-231804ae0874", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13cd20a3-803f-432c-a9f6-524b391ece17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de01f2da-368f-4c7b-af0c-88db8420888c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55689743-0552-41cb-8c34-468d2d6016d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f01f58c-d9a2-4f0b-9205-5c261300337d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d106a3a-da00-405d-85ff-91108b71a96f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98104bbf-b34b-42ed-87e4-7bc664b11e5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f44473-75a4-4e7f-9ef5-a3c7f10cada5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef7d4c7-2b4b-419c-a9f8-7caf66588e22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f7e012-4ec8-4c73-ba04-8ac9012c3075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bafa0bf-5662-448e-a121-df2824bcbfdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ada51a8e-caf5-4985-ade3-dfa74847596e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb109e4-9e76-4a25-843b-060fcf2fde1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91d33a41-1090-41cd-ad61-d22302ce1ac5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--709fa3df-3ce3-412c-89db-3cc712fc91d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e8563ed-d7ee-46f5-b141-dcffb85c7d4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08981a98-364e-48c4-9ead-70bb42bd731a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795d9aba-5772-4ccf-b678-950b933699df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52feca0b-0fe0-49f9-b55c-587a7034ae92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9800e6a0-89b2-48c6-b355-e7008e972069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--997e23ea-bd74-46f2-81f5-5f745c647784", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b3ec771-633c-4480-8906-7e2bca1107af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ace53be-0cbc-42dc-8c7b-212184995f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f07e996-be74-4173-a0e9-b65c790f18b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02024d6e-b503-4e39-b050-f79e8b7f44ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837ddb68-fec1-48bc-9ad6-71c5ebbb6b7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f37b6699-4ca7-46f7-842a-cf252bb6d2a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca28ce4-2075-4a49-ad18-313bccbd8218", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89fc2756-514b-492e-868f-6bd2c94a9706", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b145e2e-b092-4b18-850c-5ca2e5b6b9c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fbee8f8-716b-42d9-8f69-ea19644d8770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfc89710-6c34-41d2-b41a-cc49e1259b53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b0ed8b5-a127-494e-bcca-1878e01b4bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f25c9f26-4705-4f8d-8b5e-2f432d6e0e66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b6b59db-e57d-4ce8-876e-00da0868fc75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.174.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6addec-a546-4316-b3f1-ea2c14156eec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.176.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb6a7e6d-0fe9-4c75-8ded-9b3cdf86deeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62583c2c-368d-4e12-8d89-894e1e87a7ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--041f7896-b0a1-4ae7-9760-864708537b09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b14c2094-9cef-4dfc-9b44-8f9b2983c87e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edaadc18-222b-4820-a234-41aad6f6300f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.187.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c5d95e-35b9-4f00-9228-079f6ae7ea8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0405438-1c68-4560-97f7-5b7e0720a82c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--724b46f3-ce94-4058-9c6f-4e86b80453a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7510288-5436-483f-99c4-98a02ef5158d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--159983c8-02f3-4fc0-804d-5e46a905f030", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12e11fe2-e494-43c5-ba85-3c6c7e867bb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9bd2a09-f737-4746-bfa3-dd755c635caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7887ae7-b544-47a7-bd2e-f0988c13c4de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da962ebd-fc2e-4c4a-8395-c44cf837e7c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b97ee1c-59c2-4811-a947-bbb1389b9979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3625031-6003-4e4f-bf39-4c5a0e91663b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45c5706d-19c2-47b6-8322-4a557e1ca1f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b11e709-4ca0-4552-8bea-d99f5a754ae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362928cc-39c1-45a9-abae-5ca2ad2d0b95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9824177-684b-42a9-a66f-ead660407e56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.221.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18425b44-3e4e-4653-80e0-aa66674a10b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.23.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c71a752-0138-42cf-bee5-2411b869707c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d319a31c-170d-450c-bc05-8ca71d1528c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c7a483f-60ab-4ccc-9b0c-cb9fb950e60c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c693507-1378-4b79-8586-b1bed2b93eb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--053c8d4b-624a-4a67-a066-0bc0016f5047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c734c3c9-8def-4676-9d20-f23506f86202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28e913f-1dd6-4004-9348-1c7e34922e54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68610741-7928-406c-a977-357ca1475d48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1276648a-e5a7-4118-b0b7-bb408dd91d9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47f0e14d-de74-45c1-9b6b-4e1053cb5453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32cd08ef-907d-4953-bbdf-2d3019391f81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02526221-6953-46b1-a8b4-a46520d4e1f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc1d7cb-2c99-44b4-ae04-bc7fb3f465f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e27c742-9b5f-4411-92d4-c38395b224f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2239bc4a-9365-497c-a263-d0a35360410d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.42.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a5dd8d1-38df-47f4-9c5c-5c96fee3507c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.43.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9de20e70-d8f6-4daf-9050-1085f5144f81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.48.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f2f37d-2e6b-4500-ae44-64c432374932", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c8d9a58-cf9b-485e-93af-09a708b95403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66ffb6b7-e9c3-4c24-88df-37c717317bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41b3d603-0d65-4cbb-a838-52569c1a6baa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.59.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1db8dfb-c423-461a-9a49-8216020464f2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f38641e3-f16e-4cb8-89e3-82fbff1fa265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.0.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02f73420-781d-4db2-a95d-ba28df8a12df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.201.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341bf7b0-43da-4d5b-846c-f3233baec632", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.217.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5c77333-be77-4625-ab2c-4b262d8cc3a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.47.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0d2655f-fac7-46db-b832-51c8fe7d7bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.67.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f142614-8cde-44b5-bf5c-451e36165fd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.103.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d06d348-7d07-44c6-b431-a9cb75c2a869", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.132.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c1fb170-3841-40a2-bc3d-28796ca5c872", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.170.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c347a5c6-aefb-4829-a3e1-40fd0cebc931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.20.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5766d46c-66ac-4ff3-857e-e5bc48034dec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.40.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb386ffb-a41a-47f7-951c-e20ddb81aec9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.105.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f688869-8ada-4ed7-90c9-61296afb55aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.158.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f23cfc0-ffb0-47e5-a131-a991862d499a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.179.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b2c8b1-5dcf-450e-b86f-d390767db2eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.33.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc48388e-6618-4524-b2cc-3dbf3c119697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.34.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9da6142-4026-43a3-b08a-a12e8f47a67d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.61.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--243b7000-13eb-4f86-b4e2-f24f0373e79b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.176.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26870fac-2288-483f-8792-9f768cd37b4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.218.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be6373bc-3a4c-4e08-b292-75ebf32d284e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.249.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c91140-d8c8-4a54-a3f1-c5867579e255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.51.65.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2006e41f-fb03-4bca-9d85-174d4719db85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.225.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--645d34e1-8972-47d1-8850-379a93450f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.232.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b853514d-9c5d-428c-bd8c-5de43e67760c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.38.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--667a423d-1fb7-46ac-9166-16ba893d57e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.49.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25daf764-4a3b-45b8-99c2-116e5fe6d903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.85.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f809da-9d84-4952-b5c8-690a3f8afd8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.130.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2819afb7-32f6-4afe-8d86-9f0da59deb78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.133.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--792fa512-e518-4ba5-9ef8-d96b9fa0dddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.134.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c0330d8-a94f-4f2c-84be-facaad36fba3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.235.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd218259-9d9f-45c6-89e4-9d3a20b5b3a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.88.164.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef4857f-6dd6-4182-bfde-fa9c3982c0f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6c84305-abf9-4def-a90f-73b025baf6a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5ada025-baa9-4ea1-9b91-c947a7305824", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cb78daa-e90b-4776-b652-40b9be9c4f77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3947a62-e636-4b82-93ec-d8e07fb1a254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84025ce0-c374-4b5b-ac5f-89ab31eafd7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2a7a58-6ba8-4a6d-aa7e-0bb501d2f32d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d992c24b-2563-4be0-87cd-eff7fc69d31f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfdc81d3-6fcf-4368-862b-1bd0b8eb14e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e12c70-00d6-4d87-a5a0-e2d222fe7236", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24082059-9bac-44e8-b1d4-16b5be74d46f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdcc27b1-cf60-48ae-8cc0-1d747d7b6012", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--363b6c33-01ca-48a5-aab9-9a5d5340a9ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--693ce958-363d-4e84-a399-03fedde040da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4f8aa52-65e2-48d3-a407-d661ee578c27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--236ae221-a91e-4bf3-b803-0831b8e6fed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--574972b6-013d-453f-baed-29142e23ea45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7498ee8c-5da3-4db6-82d1-5f5c4c253e7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d7f4c5-679b-4595-a7d8-d89fcb2bbd69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2feb2e27-9e93-4c00-98fa-3b2ee3be13ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--411279df-f41d-418f-bca4-799f415232b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71306c6f-db05-4a33-8144-957cff36e56e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9718182d-42d0-4a01-93fd-d6f22c348404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40fa2ddf-fe2e-4a04-a775-3bd0b9b6863f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--471af2b4-bb78-4823-87f4-4127daf1267b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edbb4e46-4d22-4b58-9b8a-ca50d6569b3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeec4377-9dab-46e5-a502-233b3a2924f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--077be6b9-8d85-4e50-a186-65e7c4461a9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1ace08-4db5-424f-a1ce-fd4e1d210e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1192dad-2e35-4922-8b70-1a4f7de4735d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98479907-6a0c-4dee-85ce-d4490b0fff0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.189.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09acbe51-a1f6-433b-a728-28cf94dc0890", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.234.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56a7a3db-2ba9-4ce4-8e9d-ae7233ef69c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.241.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b16524a4-8ac6-44af-a109-e24aecaeea32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.4.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf041f4c-33ff-49ca-9337-b11c4738d4d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.4.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c4d83cb-96af-46ea-9eed-50e822f34504", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.41.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12bc243f-9447-46aa-aaaf-cafdf792eb66", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.5.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fdab045-c2f4-4e63-9432-fd71df251264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.121.150.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b535c978-8b2a-4857-93f7-6b958d5caa2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.68.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b4ca797-0957-4f07-9111-8d1c03b18bac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.76.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d88e9c9b-6e25-4b53-8a7a-201f8985624c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.83.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--944bdcf1-7da5-41d3-8d1e-bdcaaedf8f5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.90.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06938be0-44e3-4699-91cd-4c196dacfaba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.250.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ffa5b0-becb-4ff9-a74c-b05eecada115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.255.236.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f161b093-bdde-400b-9bbd-e31b962f2cf3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.116.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e663754f-7031-412e-8679-e4a3f68e1f2b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.119.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7fcf235-2e55-4f8f-a379-df17f11908ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.148.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3692538d-dd05-4595-9222-35249783f6a4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.177.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930964f7-d557-4dd2-874d-f0bac8228f55", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.186.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35d8714d-bdfb-4623-8168-bc6f23033c45", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.191.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b29d08f-eeb8-4756-bfb9-2d85e631d6c0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.192.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1854f26c-aea4-4a6a-b555-91d6e7f5a461", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.193.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a952d4a3-0df8-4c98-aa68-ac618d899c4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.36.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d06c3b9-e186-41e4-9ffb-6229e936e2a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.147.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--104be677-245c-49f8-b014-bde6602d985a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d35aca1-de11-44d6-8f0a-89d9efbc4a55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--000d892e-823d-4580-a043-4b0c5a73ba91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f88c368-387f-4112-808d-a72b40fd7d25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--053244cb-8f65-4905-80c5-19dd0ffcaa61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--987e884a-fb10-4aa5-8e63-217c4c684d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d87af863-0b68-4631-9064-c9ad141dab44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--049cd65b-d3db-42cb-ab95-76dc7f8a7f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d18f391-c17f-48fe-b51c-799e591da2d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.246.46.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cbbcafb-aa43-4e6a-9753-4110575ba2c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.254.116.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df1c88b9-67c9-496a-9a0a-4339e59b45fc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.254.229.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f1bdf3c-3746-4ea0-ac2e-4459d16f93c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.128.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed8e79f0-2f0e-436b-b08a-ec839a793b9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.153.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebab6fe9-6b81-4bfa-b7ba-2a621958dadd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.154.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c96fe6e-7547-436b-8bec-49013a599825", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.81.3.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aec8927d-572d-423a-a745-c45377e3c6df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.82.255.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b00d0a3-a306-499e-89fe-57a9bce71617", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.105.76.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cddcf2c3-a90f-4cdc-9573-4f9af13975b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.237.176.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2acd39-4d7b-495c-b747-a403c0c32c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.243.148.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3018e942-1a69-4749-9ad2-9fcf98af25e6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324cefea-e4e7-400a-a8ca-0ab9f2306642", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.37.93.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d456b324-4fd1-46ea-83cb-2a1432cc01c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.19.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00d36239-a733-485d-9951-4f4700d160b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.93.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa2cb0a7-6956-4737-9b78-26a8ad9a16ea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.212.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--264ec3f5-6df0-40cd-b4a9-f2d70fb25e3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.52.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87bf3c76-3923-4ef0-8935-b0bbc6f6c90f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.221.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91265fc8-6a6a-4321-bd17-5f54829bca59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b71f50e-c50b-4206-99b2-5d6b141b8153", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.120.202.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db0f9d2c-4bf3-47e6-913b-47efd1c1fe58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.132.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f934aa-020c-46f1-9ffd-0651286d466f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.244.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c43bb97-1207-40c3-8f93-de88728c8604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.178.115.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598fbff8-db5e-481e-9b1e-9ccc36ab361c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.178.83.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7d14c43-3e5d-47bc-af4d-3060a3eac03e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.113.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70419bf2-b22a-4353-b02b-3aa48d547e7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.114.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9054a522-ab7e-431b-a37f-f9c72a343e8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bc389f6-30c7-4f9f-bbd7-3e7cb782e7ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--254b0489-2e62-4174-b4e6-a6aedbe91420", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56dd3e97-d927-461e-83bb-e807959bec97", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.75.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9c1057-0138-4c75-9494-127fc4a3d723", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.216.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7482833-b049-4a79-aa28-a2ae27a34107", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.241.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b07a0740-06b6-4bcb-a39e-bfbedc06abd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.242.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c18832-2581-4038-ad58-40d98b7b5935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.203.245.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04bf047d-c13a-46dc-b579-eee24adea747", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.206.226.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--491154da-afee-46c6-bc5a-10b0901eca80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.24.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77dfa48b-9d82-4d1e-a7b4-d10252d4de03", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.214.209.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae3b0f86-8d6c-488b-8c11-64debec55862", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.108.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cec4d2a9-4e1e-4f66-b280-c292091af6dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.143.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d826f196-0a15-4776-8482-d97d4991f2fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.15.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2708807c-507d-4445-95f3-274f852857cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.27.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8def1e6b-bb90-42a7-95ab-3b07b9cb1292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.3.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--297250da-2e6b-44d3-8af1-39bca1f679d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.8.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28ee5452-af42-4e67-96df-deeb30990ae9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.219.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--869de84d-dd73-4168-aef2-47045997aacd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.221.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--542e363c-35e6-4697-826e-8cbaa6eb2f06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0392e6c7-2dd7-4120-a21b-343ea2462bec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b43a7d0d-1688-4025-abbc-3e49f6b2ca79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e25f94-ed5f-495f-a609-404e03c6bbcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa917b67-a083-4c50-b49d-e208cb902b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd433c9-64a1-4348-bd13-b34ebf5f9463", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85342b5c-b3a1-4f29-b42b-552f0afe66bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.21.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e61f1b-eaed-41a9-8ae4-57a4dd6371cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.217.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--784ecc3c-b87e-4ca1-87cd-bef713e0b10d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe1f5d30-8d22-445b-912f-cd6bfdd0b27f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e2720a-a808-4fb2-91ba-ed6ec003da5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e90e088c-db61-451d-a07e-47adbb1fbead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e597bf7c-e376-43e9-9a95-1a0d497fe9bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e70536-a0b3-4863-95f7-4cd316832e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.221.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8665aa0-ecdd-44dd-aadc-728dc03061d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de9de22b-6ef6-4c40-b2aa-11f28bcd0662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9dde52c-666d-4e7c-b0fa-f05dc2befdd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5a7b2d-4d25-4ce1-bf0d-dca0dcc22609", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46c56d77-78cf-4a54-b8ac-628e3648b962", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.235.40.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b165618-e496-4b30-beaa-f7237d3b2fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.106.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce02543-0e72-4634-9ccf-4e03b30ba533", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6abf641-09e8-40ce-a9d7-15baa1b6b2d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a49d5d7-bf70-4272-b0e1-848c5e7325c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe983510-2165-4a5b-9dbb-5bbdbd36648c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.117.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d132e2f-6fb3-41d1-b41c-c6af747be4e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.123.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf8c1c89-7d0d-4181-8649-554982471290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2de2ca85-96e2-4170-af20-5713a6d8ecb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34c3540a-29ad-404e-a3d6-8adf01361185", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d8c80a8-56e8-4a92-865a-82450b854f3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72bd0ba1-d3e9-4876-9a74-5dd967d63688", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a77f789-143d-43af-ace8-b0559c9cb7f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c21ebf1-50a6-4484-8bc6-8ded87d19d29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fe90b2f-0002-4d25-97fd-13e6b99ea9ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4ecaf4f-bf91-4519-98a1-ad2aee25e6a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e685f3-26b3-4874-ac70-b8af08708b77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7574113b-7c93-44aa-bdcc-7d0178c7493c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58c1c92-b4f5-43d6-90df-2dc9d5ae583e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--802c0015-288f-4d5a-9549-3d82e61e728e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60c92eaf-9dd4-4970-93d8-0fdd1609233e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b36fc1-0fa3-422b-84e4-d1d89cb7e1e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.160.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29c85f69-ca0b-416a-888e-fb66bac5fd1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.171.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ef58200-e071-477d-9a8e-9d2bdf52e10e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.188.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36ab2a58-05c9-49cd-a074-cec6a5f1df9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d7dbcbb-765e-40aa-aeea-503b62f73112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04aae96d-d666-485e-8b28-31ad6e0733be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.62.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de72d201-ea93-4d5d-acb6-6a69baed479c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.89.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d841ea0d-657a-4e27-9757-5b1704569cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.93.220.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f50d359f-83dc-445f-9fd2-0edd97980070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.117.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e41701df-655b-4b81-8a4b-e93c78a00e5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.212.223.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--905afd27-207f-46ec-81aa-36208e7a9e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.212.252.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e385b0ef-8c38-4c8e-826f-2de07fad8fd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.145.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--058cde9d-502c-4747-bbb2-e5cd820c297d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.150.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b71084c-920c-4600-8dac-7eca755ae306", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.213.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae6fdb92-e28f-4d23-b511-691debc2d80a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.214.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62efa92f-e49f-4c3e-9536-7c45b6f1a853", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.254.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d386ab-724a-4af1-af81-b42bd1c8ff02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.254.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08dbe869-5d95-4f5b-9153-0d67d23c287c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.249.36.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6083da68-df39-45d6-99cc-c59f1aeea9c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.254.207.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24146757-76fe-42d6-82bc-dd963367e76c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.192.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b376de2-825e-43df-a2fd-76c45b1b3249", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.210.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--417271fa-f9db-4e75-91eb-d8973e2ce801", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74121b4a-6672-4891-a14f-97e3a1491821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f68dd34-e845-48ae-a392-9dc00a10ec35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52cb4fdc-e138-49b1-9f16-c391a2f387c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbf2a80e-ca74-41af-8479-caf17f9546e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3db38c7b-0033-4616-9fce-5e7d24772eb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdaa2c13-b836-4d67-ba2e-b441541d2d37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--509c7872-cd6a-4e04-b52f-735250178fb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cb484c0-999b-446a-aa1c-c3250dac52bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e08811b3-e54d-4756-a627-fdd86245cacd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe1e4bd-f7cd-4879-89eb-ad240e07088f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d0f492b-aaa8-4365-b682-324e3826ca37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a43bb2e2-f4fb-4bfd-b7bd-dd96497a6500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.226.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8baec1-9b54-4dec-afa2-4fc7061a4b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.242.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b358d133-4989-4355-bdcf-3208cdecbd37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.243.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa5ae2e-8c46-4cd7-bc9d-d497915af74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.78.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--325d0ae0-f05c-4944-b419-2256a5bf92db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.67.236.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b1813c0-18b2-443c-877a-25638553acaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.221.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddb897c0-2ea7-4731-9855-a89b9cc65fdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.107.3.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8629d6b-502f-4066-8cd0-bde0bdc8aeed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.196.135.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4531dbbe-a1f4-4d92-b4a6-180f1e26670b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.203.61.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f02bb182-eb0e-4ca8-863c-4b219c2a4f24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.106.230.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e37cfe2f-cc6d-49c9-83ff-66c1e16d119b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.176.81.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b6f6db-a7d8-4b99-b1ec-f8f6cfd7b223", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.18.19.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0620455-e0dd-4d02-bce9-bdde180f207e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.235.182.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7336ca45-180c-4f59-ac1e-f73561b5b354", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.32.193.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc418b9a-19ec-4591-ba0b-da6a0d8b1069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.36.148.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0415ec-d16d-43e3-bc4f-07ea89dfe3c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a2dfb2c-45d9-49cd-88a8-c59873fd728a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7039d388-bf0e-403f-86ff-97beb83e8923", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--318a4828-4b9b-4c52-94a7-0c1a4d3932e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5cedc92-a546-4e54-aca0-45997bde7d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--896db334-c63e-4c51-83c4-f0cd9804c6b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.136.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28dc69b6-53f9-4782-9cd5-224f194582ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f69cb840-054f-417c-961d-3496234f5c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be04780-4484-4063-b1fa-882631822b45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5428c2fe-46e8-4f65-8aa9-1059aef1ae8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76342c9a-abb0-4363-961d-2adeedbeaf94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75f39c96-e672-4d00-87d4-dc472c83e2c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0ee0d8-274e-4667-a2ec-cd72344bebfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73b2eae9-d493-4abe-949b-0fd75df7fff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6417d77-49b2-4831-9cf9-cf066f359397", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ecf97c-5949-4e44-8ed0-baeb877ce199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33b5c9bd-54ad-4e86-baa9-852a09abc059", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c278d53d-8976-459a-bc41-4bc08507a241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c33405a6-029c-411b-980e-6eb84a1470bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83fb1d87-3cea-44be-bc3c-f6cbec94ee76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adda69fd-8b27-4dfe-b2ef-869bf1878819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ca5deaf-d503-4394-b1f6-f8a78e8cce90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01450f74-ab8c-4204-9977-8b75ec8e0c1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde18f09-c695-4f62-9a3c-0d939e4d7636", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4021a573-5aa3-448e-b989-7f7646fa2fb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--877fbd0d-bd1f-486c-b6c9-876b2ea8aa85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--205cc611-369d-47d8-8918-8af6e768602e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff809ef0-4550-4bfe-942f-c03c5504f04b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb831460-ac6a-4fbc-8bb1-44b96a563e69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30775f11-3a52-4deb-adeb-15dc75bd5541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dbb77e9-41a8-4109-bf35-cb1e19e42484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb7eb2b-f755-41be-9605-bd330941d916", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e40b3f3e-8d46-4836-8b32-f34db806efdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb0cb96-e38b-40a5-a2db-9bef414376bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c8ce7f-51f2-4708-b517-fee7a317cdf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbb8b734-d3c2-487e-8910-d2f50077cb23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e690136e-a2c2-4633-81d6-d2b37c31fab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf73193-b260-4891-89a5-ea5610a25d0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b757ce8e-88a0-4c25-a703-c1350d4c1f40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e43e3904-ccdd-48db-b7a8-511099db7a76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1206bad3-ad6d-4d43-b4ab-3cbefd5f3fbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91357f1e-5f13-4601-b7a4-05fe4ba66792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b939fc79-de5c-4051-ac98-db5289352f93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f1eb3fe-bacd-4dbb-9940-0be85231145f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d581b25-e098-49f4-9e37-bb893dcb7353", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f0150a7-d763-4e15-81aa-e13b7b7bcd3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f742af2b-a51f-40f8-ac53-d7b9e0768095", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8358178-8e44-47c9-97eb-5ef1f086390f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3486aab5-85e1-4c4c-941a-fa99f0add7c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ebbee7-c6c4-44da-9e54-6b2241fdaa2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0be8d5c-3ae1-4f9a-8bdb-a742b3d96c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--310ee24a-4abd-457d-a6ae-1a04431d2216", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05f6d2f6-97d3-44a6-8fae-3028905034ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc365034-03bd-4d21-b932-591847b4da36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f3f06db-9876-4f46-922e-bdbee403c1d4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.190.243.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68b7ca03-3764-42ce-a81e-cc5404377680", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.195.35.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df3174bf-bb06-4a24-a4d0-d5b2fe8935ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.22.174.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--560b1e4d-36f0-43ca-b33c-0519ac9191ca", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.222.60.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7c98765-def8-4b64-bffe-4e32af539566", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.225.80.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dd5fb71-27c1-428f-ad1e-05daff87713f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.241.163.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e56d2b77-6fef-40a9-872b-7a90cff3996e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.249.60.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a8307b8-20c1-4928-b650-bb04ac64590b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.41.162.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bed6c265-8cae-4095-ba0c-fc3d182df566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.67.176.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d3eb648-c1c4-4d14-8c77-ca43fa76d4e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.69.176.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5a8003-cd70-4deb-93d0-a8d7b403304f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.95.69.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b242112-b156-433d-9797-828814ddf1a4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.96.119.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bc7b43b-d410-48e1-95a6-d9351ce13288", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.120.6.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0668ce6-21cc-452a-bd39-d01360d6818f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.147.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c151e851-599b-4223-8ab3-c05db72e38ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.178.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aaba814-87a6-4b0a-970d-c8640d4a1431", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.54.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74523c57-8971-4003-8a52-173fc3bc239a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.175.130.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126a5fcc-ac80-4f42-9dc3-c09b6ba924c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.175.142.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f336d5e9-4b01-4d5d-a8fa-9e474b7694b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648a6644-a8f2-4c67-bb79-494898fb3100", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22c3600c-1b79-499c-8cbd-e29eabc8cab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3763d8e5-e14e-4597-90f4-5fe28b0d592a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.213.79.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02a4ff26-d0dc-43ab-87a2-2a122f7d1869", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.254.236.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73cb9883-a083-4ec5-95e2-c06c4d50becf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.116.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03227e3-c73a-4c56-9a77-95fc087226b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.198.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a87b115-5395-4ddd-8b71-9d8bec911121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.216.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57a52ecc-415f-4e07-822e-bdb56c35e70c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.245.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eafa694-b812-4ad5-88da-b1010d6c42b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.55.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7b27098-5ba8-410c-b6dc-b0f015e197e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.72.184.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9313974-1221-4b5f-9758-aa5dfdee1731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.83.200.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d56243-14ab-4cf4-8f79-7e9112832709", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.124.135.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad313dfd-45c3-421b-bae1-8194037246e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.127.146.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2940e930-d33d-4483-88c3-6eadd077d45a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.174.27.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff917a5-6025-4987-8f13-412551d1cf9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.214.40.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4f5a7ea-2582-4c43-b4bf-f30f439083cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.146.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c10015-32a5-4a50-b2f8-71cd91774481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.48.228.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8471e638-3a3e-4914-bd28-6c9ebc66752a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.61.232.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7183680-ed0f-4546-bd1a-1b773914652a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.61.232.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16aa345-a2eb-4156-9756-9ad3e51d9279", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.93.231.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e61fbb51-59df-4436-80c2-3f79f7653b99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.119.209.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a9b28e-e519-4788-bd8b-baa248a9e2a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.133.199.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab41a3bb-7db1-4920-a924-da6bc17c7f42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.140.44.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec7b3ff9-4fdf-4cf1-b3e5-a882dc11b269", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.189.74.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d88900f-ee3e-4995-a3b4-609d1d6310ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.190.15.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab21da4-0662-4143-96f9-d0c4bf041858", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.208.181.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae50b616-e59e-4878-8b2c-42284d851450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.212.227.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e49ab4-c2ee-4ef5-8b65-0e90faf68373", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.217.208.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fcd80a1-2703-4d4e-ad97-a0ba552b8b95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.179.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8e456f-8515-4dbb-8d7e-f74efb4676ec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.103.119.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--231fffc2-4c91-4800-9bbc-39888194ba1e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.138.194.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a8ed35-b8ab-4ab3-9260-10d135287c2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c87fa53d-983e-4933-b4b3-7168857f8608", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e94380a-f678-4fbc-a3a4-741e52df8e49", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.43.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dbbd57c-3fe2-40ca-a0da-6b5c9335d43d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.210.128.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07662084-6300-423c-9eab-f25d897f22dd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.213.44.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7e1294-8ef7-45e8-b462-0060af1808c3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.235.129.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee5acf0b-074b-44f6-802b-a3df7d74b68e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.250.196.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cfef5bd-dcdb-40a8-896f-60425c2e060e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.75.172.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c77d8173-efba-49bc-a94c-a681a9358a62", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.168.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c9791b-a0c0-4759-b075-562f3ac5b9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.172.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a7c778-9e06-428f-9a2d-695793d02143", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.234.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a1b98c8-d301-4182-9538-4b035f7d9678", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.95.238.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ade92aab-a4c8-4476-bf6d-00eaa63b7e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.110.165.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d30d72ba-4908-4b9e-b306-879f26aab659", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.115.146.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7c47d8-855f-4bb9-bd7c-1f1cf0be36fa", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.127.239.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--698f221d-9bcf-47e5-970d-a826a3b9b99f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.188.172.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbd98da9-03d0-4cf3-839c-c389dfdc40fe", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.188.176.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9d01bc-07bb-4278-aa19-4ac7eee6ab69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.209.75.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--757ef6f4-f375-474c-aaf1-ce08ce15d05d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.214.173.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaef0b84-23cf-46e5-bcc1-4a9ed7cf0007", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.79.80.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce424864-229d-4a45-8b2d-5493eb9ffa67", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.91.86.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71f8ba40-184b-4ea2-8f70-98a126eb8770", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.94.246.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4e92f63-63d2-40bc-b13d-95042d77eefd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.105.224.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6405354-6d40-4d3c-9703-ed52bb353f10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b709ee5d-dfd4-4d1f-98c8-f1fd4ea617f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e80d764e-b967-46b8-b715-97cf57eb80fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--767713e8-5375-4879-9351-a87a399aef7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.16.3.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0c797be-de71-42fc-83ac-be69580b85e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.242.168.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336ec8c2-6637-4537-92a6-5b6176823af5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.53.176.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff80056f-1041-44b2-b1a9-ebd81e1c4b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.53.180.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b9ff36e-7a6e-41ae-84cd-aac33dfd144e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.54.159.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2131cf06-2d6e-4eb1-8a48-6b8b0914f968", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.92.202.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba1f2b1-6f30-42fb-af1d-f6288e881c65", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.128.240.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f1c316-f0e4-451a-a641-4cf4e42f113b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.162.123.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9badcf2a-0280-4788-84b3-c532d2997b6f", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.236.101.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c98995e-c34b-4d53-8b67-f5eae900751b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.36.35.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc9a05f2-65f3-4c4f-8389-ebc6ea0aa214", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.81.35.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78cbf6e2-f7d7-4481-8883-fe7da6aae879", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.186.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df63f92a-2df2-4150-a8ea-fedfa5a06745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2421e96-a9b4-40a5-a4d1-625dfb616b7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c598e885-f160-44b0-8526-9acd2efaf818", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--260d50ae-4e6d-494e-920f-5a88b79ed864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa29540a-10da-43e4-9348-7bb283be332c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a10a87e6-0614-4768-aff8-aa2f9128a1e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d3d0e2f-76d4-45a5-8cc5-4b13f543b4ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92da3ffb-a8ca-4628-ab5a-9c88f003a388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ff3d92f-d8af-4935-89cd-6c1be6c420c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7830493-6b0b-43fa-8555-74535b1cda82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d1a7af-19a3-48c1-903f-c9da2797774e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48838dc5-51cc-4993-8b26-5224979efc6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5e80a6-93ef-4025-9dc5-99c78803cb73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9160125a-799a-486e-9339-0c7747d04be2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9337178-908d-4775-ba4f-e0e6b5283137", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a45b7196-b44d-4bf4-a272-692ebadbaeb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6a82e45-f752-4d5e-b0a7-601d4a36ff2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5875b038-6ed4-42bf-a5e8-385e1cb8bf62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1e55590-7761-4a45-93e5-55be3f9fda2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--593ef4ff-36cb-41a4-a3cf-add36e2a3612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eb506d6-dadc-4b40-b0a9-ba4c87e04ec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cea2453-ccd9-4c52-901a-fad74d81dd9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc0eb85-a6dd-4396-b525-15bf432448d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aedc7708-04b9-459f-bea3-f0a71b648f3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99bf1ffb-9bea-415f-b430-c9b122ee66d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab816dab-e742-424b-91fb-de38059ea43f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf233e54-096c-4a61-a10a-ebf7d4058b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.107.179.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5b48159-b959-40ce-ab8a-23b47406f4d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.78.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc88b21-7065-4f9f-a09b-425a6e860a0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.54.241.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af8de379-2a61-4a48-8c53-6bcecd14be70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.73.145.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3b2b271-e06e-402c-9a61-c55c9d78b53f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.107.80.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832f186f-9a32-43a7-aefd-0b5cfc6753c4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.122.255.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d58706f-12c8-45b1-9a9f-74c497699650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.135.137.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5e3d06c-1ac5-4a21-8caf-874b5cd0a9f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.150.191.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f162a39-3239-417b-9779-5aabd5636f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.156.73.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--165c35d6-bf2a-49a1-a2e2-1dc3c44ba7fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.156.73.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd2196a3-aef3-42a8-90ae-d7489e08b20c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.156.73.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9869186b-444b-4602-b9ec-f78620c016f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21e782d4-9482-42e6-8542-1034eba82865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6771ef50-b40b-46c2-9308-3bce81768281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7f49b16-0b13-41b4-9b6f-3d18b325dead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--326e0ed2-25e6-4a50-beae-5f4e54f4f2ee", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.205.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e7130e8-75ef-4f8c-ac69-7f91a7072605", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.182.217.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d85f26a-7287-4d80-8db1-9143a1714d22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.114.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--954045b7-bde2-4dae-bae2-f44e59ae6115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.114.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7751ccbb-90ad-40bf-b085-9cd094805cf3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81ff4be7-9806-44b0-8fe7-7f5ea22193e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc60bbc-c2fe-4782-b332-d4eedd8a761c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd0f095e-a513-42d9-ba38-f2d01f92a248", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--115becde-b9b6-425a-bb8d-3fb031107e66", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d37f562d-8834-4b2f-abda-c4c3145aeccb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072d4695-432b-464b-afdc-2694377f2f66", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8bd821-1316-4b87-b58b-cb5750da1118", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c371f86-be3e-4e95-8700-03ac1083ebf3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a8e7fad-382d-4ebf-bcc2-3e6feec411d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4543b2b5-6dd9-40e2-8ffe-b8911c9bf8eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec4779c8-54b8-4a3d-9bbb-db46ce1bc9f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed54cd5-348d-40ce-9c71-ee50ff085714", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa744e41-6f4a-4c1c-b2cf-c4c22fd83fc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3f363bb-a5ee-4648-a633-5520f345403f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc363f8f-1751-40af-a1e7-2b9e4d79dc58", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e75f81a-d030-4753-be10-3039cf7124e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46183d6c-6b9c-4cbf-be76-c4a96a542c39", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d303334-eeda-4492-a079-e812452d1fb6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ed0e76d-4341-4d53-a1c4-1178971e9fb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf902e70-3f36-400a-ad51-e2d0915e3a29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569d87fd-4975-42dc-9ad9-bca0c6d77d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2379a31-9daa-432e-ac9c-0a21ad46446b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e06725-920b-42ab-ab9d-59ee83acb77b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fb86acc-f9a0-4001-aaf3-cc25da1f4a40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aa45171-0540-4097-8e69-d6bb3b6fbc03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eabe9bfa-b8fd-42dc-aa70-dbf0656065c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aefe76ed-68f9-4f7d-904f-993c2c103ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64be87ca-dd4e-4983-a36a-32a7cf8aa459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--430b3c67-de1c-4ae1-929f-df5bb8749710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a3749b1-d007-41a4-ac81-09612ac12fd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--370c6754-7df7-4cbd-a5d9-1f3ea063b0b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.216.145.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73c930cb-9c94-471b-86a7-c25d569dcdad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.217.0.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1afa71c-494a-4eee-b21e-17f3375055d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.218.138.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d1f473b-68d0-4e5a-a52f-12e7429ec9a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.218.138.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d4b8d91-3139-4c8e-b536-393e6aef94e5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.221.216.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--382586cb-87f4-4ccb-a2b0-9b1baa9d3d02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.222.138.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e2fb14-559a-45d1-bdd7-a66570728f69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.224.128.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78f8c96-a2cd-4e42-8cb9-d296ef6fd200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b534ece-d645-4115-86cc-4763721ff7f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--696b8ee0-1e4f-4758-a43e-bebf0bf6e19c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4427d953-2690-4328-8eaa-c5e9652746ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--196c1d81-2dce-4de2-914e-c83d880e7f3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91213658-10d5-44d3-8404-5200d3844fb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0f9040-c528-4e3b-9d63-8e13006afd49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.93.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11d29ea-3804-4ec1-8f64-1ab79d50c34c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.228.135.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--372415e0-069e-4d6c-8cbb-e9cd1bc00746", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.239.84.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a9bee84-b69f-4cd5-9948-14bc3ffd333f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36233ba2-39ca-4d08-8157-e275764c23d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84d07885-0879-432d-abf3-276ac9864403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffd021ed-b38b-43e5-9cd3-ce3c599e58d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfde6b8d-4b74-4965-8a30-dc6f7e91a2ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99f49193-fb6e-435b-a999-f69a90d7e28f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1c343d-1f57-41dc-ad12-7ad4cf19ebda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d5b07f1-57c0-48d1-aaa7-0b70de68220a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83a39c97-97d7-487b-b816-c99b83929e4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5734260d-e7b8-405f-86d9-13e575ff1a01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2130195-6e62-471b-8e94-55fbc99661bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebccfc7-191f-49c2-81a1-7fba575a04bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c84842ac-c213-4c3e-9689-427aac489536", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7fc4b41-50f0-4b97-996e-735650e2859f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d1eca7-0b14-4a3c-a6cb-71d668146be0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca5412fe-db53-4f66-8267-234b8e51314f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d25b8613-4436-4699-9442-a0b2713d35e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.243.5.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69440be9-69d4-4fe1-aee3-73310a4eeae5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1af27a3e-8b14-4bbd-8919-098b94fb9439", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.36.81.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db0b4a57-d477-466a-8231-6b2b7f655805", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.65.107.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbc7373c-33f2-48ae-9162-596a0260cddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.91.127.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc033d71-1400-4020-ad28-20f4859f27a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2135f74c-10b2-4888-ab40-775f96de9215", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.94.111.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab6ad826-2084-4096-91a0-0bcd14ae10ae", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.132.5.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7959916-6dc2-4f1a-a768-d9e3c9285d60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.167.112.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8131c2bc-fdfe-4405-a46d-205315ea1b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.192.53.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--559528d3-092f-4973-b589-c47ecdbca595", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.220.38.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d50eb55-f71d-47ff-8f7e-0a5556a58465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.226.62.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bccb7c9-a437-49fd-908a-6ba58ae724c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.232.138.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edf3bd2d-0d2d-43f2-a168-fd51a6987123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.233.184.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5018ca88-5504-4c91-b624-29ad91af7edd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.243.18.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd8ccb7-8338-45e6-a858-ff1f7725e8e1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.38.26.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d76ac84-476a-4c55-a98e-0077df5120a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.54.168.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--212e2b4d-64b7-4c08-ae5f-30ed58f3a470", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.55.29.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9089cec-66f0-427f-8c82-b79d44ee7eda", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.72.168.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a5a344a-215d-4c74-bac1-06198fd0f909", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.120.189.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9463ad-70a8-4ff1-b82e-bdaf565ac14d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.136.59.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a053fbfc-2969-4b32-8d49-6b5ee140295d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.141.71.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--993c0b31-7164-4281-a5c7-47438ab5c58a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.170.31.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--190d329c-8f15-43be-9bd2-d2e01250b6dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.191.2.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9404219-e5b9-481d-8833-1b173ec96b20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.191.20.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19570576-ed74-4775-b3d6-1ade562a6db2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.210.77.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0383a65-a23b-4f94-851a-e524e875fbc1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.225.108.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed03bedd-c204-4032-bd86-9ed91d6d0a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.251.197.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dafcd5d8-d1cf-4aa3-9a0b-7181c7138f3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.132.199.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be92e537-b24f-4a67-9251-2c7305965419", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.165.26.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7d0dcc9-d74d-4845-8099-a7b00b8d43f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.10.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26fa7c01-d9c7-467b-bcda-036a9ad16ecd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87c80548-57c9-4f5b-8bd7-f30f3f163b59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252e39f3-98fb-434c-80c6-eb7593916057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da23bb64-f1cf-47ab-ab7a-3ba445460012", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9254050-8035-4367-9b65-a0f408df0f42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.240.59.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca301b4-d029-4406-bebb-afe39f59c0c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.245.112.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a58afd4-1f49-4ce9-9f5c-e668dde3bba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.3.99.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79338cfe-a473-4793-b757-40a54eb7eb4a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.40.21.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f159b8-f893-4cad-878e-09285c842376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.44.20.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8b350e3-494b-417e-935d-bf7e5ad0c45f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.44.20.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae6df6d-8920-4fb8-aa4f-a80d17f42645", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.53.109.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41f33c5a-55fc-427f-b47a-0bde6c5b6ab8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.55.89.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276daa85-5fca-4940-85a8-d77b1698713d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.92.241.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c41b3a83-d009-4b1d-8a44-8267128d3d67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.130.104.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--555232d8-c04a-43dd-b7b2-5fda010796ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.130.198.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88463b6-18da-4df6-a0d4-f4910b81cc85", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.143.236.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1486f4-45e7-436a-8248-aaecd8c7d34b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.146.71.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b4d296-cb94-42e7-a128-3f82aa6f856e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.169.106.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13d1b069-5a93-466a-8f8d-d7eb7af4f619", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.197.83.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a22c83e0-6f07-4a9c-8ea9-f7d53f4e860a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.203.163.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5749fd83-0040-4129-bff7-7c9f7000e7ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.232.161.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a39d66f-b7ca-451e-8705-61b07e7e7fd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.244.70.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b2dbce7-8f41-4a2c-a9f3-8043d35042cb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.50.142.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b230191-37e8-41ec-828e-57af8ed212de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.90.40.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--111bdf0f-7aba-4a07-8445-980789478985", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.111.226.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67ece8fa-09b0-4335-a9d0-481381c72c09", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.123.65.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c57a0496-1f94-42c5-bb1e-d1c8b29baf0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.181.4.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84bb5e01-314b-4585-8a7a-944841b52615", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.196.230.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61652223-7a6f-49fd-ac93-212610522fe7", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.202.27.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f003a67a-0e3c-41b9-bae8-1b47e7fe4d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.225.182.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84c092c2-b901-4abd-9145-a759516b1524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.31.101.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfcc49ce-28bb-4e2e-80c7-fe7d5926d996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.61.55.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4374f0ba-d9ca-42fd-a28d-21eb54573817", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.80.90.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3e88b27-5d99-438a-b565-13c09e8ba257", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.85.41.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15f04675-4f74-4c92-a2da-92349390711c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.95.224.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3bbc729-6b33-425c-b68f-e37239cdbcee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.101.33.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b0f528-41f1-4a7a-aa0b-de6e693472cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.101.33.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41157a92-0b2e-4f01-bb4b-78d302a83d14", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.15.5.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22473382-8770-4425-989d-3b7468a64410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.241.76.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73518d88-2467-4c8c-af58-e8e4b44cec7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.8.7.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cba2d799-285f-4cba-9d62-bf8248dbcff1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.96.110.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ed4fe7-ab0d-4410-9cc5-3de6738cab36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.96.168.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd99216-eb64-4654-964f-75efa84d1844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.99.7.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff598894-2553-4278-91c3-7db9a4e34dcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.81.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5808ab5f-444b-4404-a05e-3b902412bb82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.84.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61eecf2f-874b-4f15-89f3-802bdb3ba9cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.88.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ebd54a8-b628-442b-87dc-7c3e42c8d634", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.90.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93b3de0b-ef95-4b27-97ee-2fa884f26ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.159.99.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b45e740c-7430-4b8f-9c11-0301085213a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.194.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0713ad38-07b1-42b5-b62a-8c2077ef5424", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.198.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b55ec76c-ca62-46df-bb3c-16c14c723950", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fac037b-4fe9-4aab-a9da-32e30b8c9eb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.3.206.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eafb69cd-720f-44ec-8be7-cad2b72ebcd6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.36.109.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43f5b0ea-f189-408e-b42d-2630ba49e987", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.36.109.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455339c7-eaae-4eaf-beb4-70138ac9dbd2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.71.126.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7937e7f-3f54-4c1b-b11f-dd727638d542", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.71.126.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da66cdb7-1252-4343-8f28-89d68900fe77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.81.215.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea14ae4-51f1-4f1c-aad0-65c75a6f9dd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.95.10.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc406e27-e26d-4cff-ae6e-c75610c27df3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e01a99e-4812-4ab9-b4f1-91d20c8a09d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c7b4adc-8cf1-49ab-b454-6eab7c339331", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9345b21c-79ed-4cb1-b158-dc4f5cf45e7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e603d165-a893-4c94-82f1-1260806be7d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e741f154-e00a-4a0c-9861-16f2b0c1593f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e4936e2-4800-4805-bfad-83020bc3d9c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af4da165-1935-4545-8086-edc177fe8379", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8a6e988-e845-40ce-a439-60f1aa870442", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a9c127d-b956-4885-acc9-4b1362a8675f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f24fd8e-08fa-40c8-a11f-51112ee5598b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf960c85-caa6-404b-94d9-9a9568428608", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--962276d0-c60c-4293-a80e-079361a94c3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec9af2e-9f86-46f8-8434-302488287a94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80ff6c08-d3f7-49fa-b477-47e05bb22e84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.124.20.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7beb0a25-7426-49c1-9efd-c3411aa60c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.142.43.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e725ebc-80e5-4a41-8512-3a17e21d6cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.143.1.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07c915dd-5cd0-41d2-bf0a-889ee1754a7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23257de8-d4f9-490c-8544-5fdc521ea86a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf920e4-1c11-4cd1-b0f1-37e1e610ad22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f45cd2-f12f-4f99-8db8-c8fd8cf10e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1be7f1c2-017c-4b34-9769-5402446996c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5884c39-40d2-4109-9d04-8f022f209c3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de209ea9-983f-4562-9c3b-6629a06e4a11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b590546c-4d75-4cb8-9994-6b321bc0f841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33fd94d9-25a8-4537-8c51-852f836e2ce8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8500db1-0271-4ad0-a366-48b0965bb7e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7df563a1-dd19-4d52-8658-5017aeff376e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--283c9a9d-397b-4d1b-9b19-21841b65d903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16686b31-e8bb-42b9-be41-53d9676b7e0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b53544a2-55ca-4954-af20-17eaf1c472ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a038407-abb0-4671-a17f-185e1013b32d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae83d0e-3bf7-4e7a-a626-279ef55cb37a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b856c3-5b78-4efb-a9d6-0d19771e94b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76b456c5-2056-4ace-83c0-5c801dc5c661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7e785b9-78c8-46ce-83ec-0d4f9f34bfc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1c6016-8e75-4f2d-9d86-a50a4b7d1982", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aad9ba9-adfe-41f5-8862-c467cd9b8b69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bd31e5d-8e32-4426-8aff-445fd0931f71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09e6c93e-2ea8-4393-a585-e2cc8c89fe1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98d8701d-0720-4490-98aa-cd1da906f0d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff79b53b-3d3b-4c01-9d1a-49e67ab005a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c69522d5-5365-4836-8e98-7eabeb76b7d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1732fe29-c78e-41b7-b61a-47fc3ec65759", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e06d9cd2-67bd-4243-824d-040e66ec4ae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f43e8ded-a5e4-476f-9837-59cfb7477e52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73363de4-a4b2-4fc7-bb23-7c33250297ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8568442f-bfdd-4491-b884-78f676987530", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed05baf-af72-40c9-8120-4140be035a28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb96aae6-b2e1-45c1-8d5f-c029e284448a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603a49d7-2067-44a5-a816-b9350987bf39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c26705d-d3fe-4c13-a1cd-4c077d5b2de8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22155cb7-45f7-464e-b254-9dd6795ef963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c22417-231a-4de5-9ea8-fb3d12241b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.194.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b06edbe-12c0-4707-a01d-ac27691dfb95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.194.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3d0fd4b-927b-4d1a-916b-cd324d03c52b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf47fba-b8e3-477f-8bcc-9a4529ba9bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8bd7783-22de-4f74-8922-00e709378c7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bacfbcb-5a76-4468-8900-7d94a5e855e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.176.29.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ee35cb1-0694-4281-8b8e-1d8a60c65b63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.19.109.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7a4f25-2d9f-4624-85a0-f95789abff47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.221.200.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c046ab39-3e2d-4700-a609-2aea81ff5e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a98af2b7-91ba-4682-9974-c97391c9869e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8415e9a2-1068-48e2-9e8d-3c4c8620f23a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--493ed34b-2875-4b85-8f3f-4638b5946321", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22f67053-fa28-4f75-a3fa-6fbb02c61acf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e798526-776b-4ef3-a5b4-44da2ee32ae8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d22e6f11-fb9d-4fe7-8af6-2578d3780d5e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e3e8106-0d06-4685-98d3-9ff40a27dcda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80a29a66-94f4-4a94-bf59-81b45f0a877c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9e15abe-3ca1-4e84-abd2-fc49e7b069cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a4094ce-f976-41e1-9804-7c148b40d0fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e633446f-f3ec-42dd-bed4-e74e3e2b973b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98d518aa-ad63-40d5-82c6-fee5f1c402d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.209.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a06164a8-4cf8-4859-a787-d08685883996", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59a8f481-ea00-4ad4-802c-fdf507a0bd53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.70.122.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24327486-3467-424e-8e5a-2161c629f355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.120.230.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b028f50d-c43f-48bf-a98d-281877ccd034", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.147.93.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56c114df-ad4f-40cb-8c4c-7b99d746b460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.15.52.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9f8c9e7-e73a-4dfc-9c1a-7badef5e1776", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19cadae5-d175-4c3b-8f37-4a69e05b6069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8825ad9-644f-4d5b-bb12-2056d21335a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.48.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c60b805a-3521-4498-9b76-8ef6d7f12a66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.49.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b51bba8-fc98-4342-ae91-af32d0209e7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94025145-e0ac-4a2d-a3a5-1d3cd616e74b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66edf3f1-9995-42d7-8191-700b53f3a4a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21bd588f-58a8-4327-9a47-511f4b158f30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eddfb00-14cc-45ee-ae0c-76f0198d4a50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a2e4e0-45e2-4445-bdd2-7a88914b14d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c62ef264-56d1-4fdc-bd41-3bd3dafe326a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.195.117.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b1bdec3-8941-4098-9478-8100c93e3183", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.213.3.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20c6e1e4-41a6-45a7-b015-102536a97eb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.42.205.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae4d4217-76d9-4099-9669-7ee515103a08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.5.82.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9045a17-cb22-45d2-888b-70477accec69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.50.235.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a85514-f298-4f79-a710-365bdb60c066", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.59.206.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ff319c9-808a-4bb7-8ce9-aadf695ed80c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.87.216.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53cdb68e-0ff6-4faf-a329-8a5b4936f003", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8565fe24-c941-4daa-9b37-b064bb1c895b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3843685-56cd-4a30-a92d-071cdfa9126a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26adbe0-dba4-41d1-89e4-76ab26a3cf38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a56571d-8119-498e-b565-f6944300f2e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e714ca39-6953-47f7-a0c9-1d12b4d44f49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bc5b6cf-256a-4890-82f7-fb1558a26dc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eb8a59b-5d8d-4723-87ee-558adcd2c39f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faa9d69c-9192-4d35-9a30-35fa8326afd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c59c27f-78f7-48ae-8229-0bfb4a702696", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa6a841-e27d-4d2b-99e2-ba6a1c8f1892", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--542073f1-d875-478a-adc4-e82d8324fdd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b08d9e3-d724-4864-91e3-2e07d3b5afb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a580e1f-54e4-421b-b4f0-9b55d15ab307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd726da-2e23-4d21-b248-89c071a7a435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e077a3f-ffd6-4d49-a09a-3996af640599", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7a34284-2a2f-4a81-ba3e-87f870c290cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b08e1f3a-6416-4d8c-a7ce-e52f75787938", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aa22dad-dc1b-4101-b673-0093be2282b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.88.98.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9091101d-c3cd-43ed-93ed-65e2a6688af7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.140.214.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44824c2b-3578-469a-a0a0-911600384d1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.154.211.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d635fa2e-181e-4ad7-8df4-4ce8016d8a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.158.16.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb5bd649-da82-4bb3-85ca-32d06a12eeaa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daec7517-01ec-4da8-99a3-2742a5b8c866", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde288f5-d9e9-4957-8afa-5ebe9b5c2c31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01eba3ab-2f1c-4764-9bf3-f1bff2fe8264", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bec18229-955e-4dba-9d9e-c0eaa68557df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5dc45cf-63a8-447e-abd0-c715b1730a75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb8d0a8b-0b4f-4d53-8c84-e42b026abc9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29e8717f-18eb-40db-beef-f335f117411b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d04a0302-9570-4d79-a093-de34ce40a36d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d6c47e4-4b0f-4fcf-a76b-4b82d7403cda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad513f83-8294-4892-ba7f-06f16c190cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.201.140.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e76c414-000a-40de-a713-5fe284a91c75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513ace1a-2fb5-43e5-aee1-2f19979379a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62d75468-92b4-434e-bf7a-3411fdd22037", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a70a85a8-61c8-4b62-a71a-24a0c842cff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74e5f7fb-3f20-419d-9698-07983dfac757", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.206.182.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d109e8-68b4-4b24-9a6b-cb7ef4680faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa55151a-d9d5-4161-abbb-2f44b8b8535a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de37135e-459b-4233-b2bd-e5f5f7805439", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d3466d1-3d41-4994-8db4-689b69dcd6de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8367ced1-de3b-43bd-893f-0e720d116bbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d200ddba-4b4d-4e8d-99de-b8a866870a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acf1afa5-c552-4f3b-b8cb-7ca4c134cf9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.250.79.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c5863ef-5d34-4519-bc8c-2657606ce702", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.49.212.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecb1ae6-2e4d-4858-96a7-4dab676cbaa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.64.239.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c40141e-bfe1-494d-a069-ba07330c35e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.139.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ccc5714-912d-430c-8d14-3c0f637631cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.139.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b556350a-674a-4ce9-a3fc-6c24ec41ed93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.189.25.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a39539-c1ff-4a86-9315-98eb07592c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.191.144.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d152594-5311-40a7-ba58-6ad1cce04e00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.191.61.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--176834d8-f2f1-4f4f-99c1-362e3943355a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.196.150.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5da96e3-2df6-4b73-9abc-c187f8457da5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.202.19.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7870b848-dd77-4e78-8c9b-63af6742a781", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.204.71.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f580c530-9628-4cc8-949f-998c624f1dcb", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.206.225.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9be6e6e0-75d6-4109-b7d5-669907d48b69", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.218.222.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c36bc389-4704-4e18-a313-e0b519f364c5", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.218.27.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7634fe22-df48-4bee-9a9c-c921282ea60a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.166.232.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e87e7bdd-f86b-43f8-9c3d-45764371dbed", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.199.224.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6e52861-4279-4946-9677-6af847219d08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.218.115.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1adeab5-8acb-4ff2-a877-f795328fa5d1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.248.104.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2ba8765-598a-4007-8f5a-3c7a476e762b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.248.8.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e4ecfb-b74d-494d-9c9b-b758bd2e94c6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.5.145.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda048b2-fc4b-4c0a-b9a9-e807e6180326", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.11.183.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ec0bfb-688e-4efa-8caf-51fd9b537697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.12.115.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--660eec49-a8e6-42e3-a40c-04ebca045725", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.12.90.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373529c4-c9ba-4289-adc1-26d1d9504c58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.199.106.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--338f5603-93e2-4f6e-b3fc-170fecd241e1", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.211.107.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad70426b-62fe-4aee-b66c-499af347301d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.211.113.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5473b0b-6004-4025-991c-90bc6d838242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbaa963c-5add-4060-a98c-c852ece6bbf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64dcb23d-8297-4111-82ec-64f5f880397a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fc33ba1-7e2d-451b-bc38-16f39deba7d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e24c4a6c-e877-4499-938c-66c5d7a6ec3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfdd1e7a-0939-4271-afd4-453fc1d90316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f4dbe5f-18c9-41c2-8af5-3f1a7d8d1d61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da09b1c9-6967-44ba-8c67-819cbf2dc76e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eca0278-2b81-4b0b-810f-e45f78e34a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f032316-ad53-4498-9677-53d6d1d828dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5874187e-2b84-42fd-ba1a-0aa447c023cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bea9c0c-d249-4e35-a0bc-f55bae91d7ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b882309a-ef55-4b7a-a520-b042f867b9e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83430945-1de9-404e-b03f-332e573f1570", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6194af5-964c-497a-8bb4-8c024a0cff70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53d64ba-e88b-4250-b381-4dcef7cd9efa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5153f1d4-1a43-4433-8c68-94dbace4bdaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4e023c2-bb86-4c7b-85b3-a2bc8a1f2f6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6af4057-1f70-40fc-be50-48e0fe984017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5609571f-b978-40d0-b0c1-1bb834ffd7d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--383445a2-7145-4d4a-bdba-ff2e2755689b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12c73c21-00c8-4d1b-a8eb-75f7690e8ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56558ddc-e3ef-419c-ac98-adae1ea907ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ffa3e22-bba6-4379-8702-71fcfa3a6af9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab7927f-4bf9-42a4-b3a8-6a6a0a5fda30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b8abab3-921f-4414-bb1e-e0b8a4b3672d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--615bc7d4-1d55-428c-b25d-85d7918edd1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3be6868-d692-4a72-a450-926daf4f2ee8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8f3dd9-cf80-4317-9bc6-b432ad487cba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bba0c73-6b51-4719-af6c-294cbf435f59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6c37371-8463-4d0c-b316-46aa20a5c066", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a394543b-7e30-4483-8782-da54d429ee91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e80f5a0-6dcb-4a21-83dd-3a7fe7e691d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3c928dd-eb47-409e-9262-ec991bfdd3bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f30110-8e9b-48ad-987f-53b67521b179", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2897b70f-0666-43a4-82ea-dc772e16ab02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--651d4588-3a99-4f1e-9cf6-d88317959599", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d3b9e7b-2e39-4bd3-8447-7a03d472bc29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf8bbd7c-15f1-4bfd-b06f-23af9d4a6f60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--942770b1-9296-48ca-b7ac-dc8a475e9931", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd472ed0-2915-46a1-a99a-17becc168323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c50351f7-df3b-4ae5-9992-58a2014f1eda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1326b90b-e9f4-42e1-ae22-c3bcdfc25b00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f009b50-7ead-493b-82d0-85e4ec3796be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--013da010-49cc-459d-a74b-32a7c2a42216", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9280dfa7-08a6-4d56-b5ab-5d58495dea52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0428a419-e0e5-42b9-9244-31f5435f7212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f5fc722-450b-424d-946d-3839db7c5cc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a311a48-f62d-47e3-a5a6-5a21c0216841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800f8929-9608-4fb7-a706-eb6402d806ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae8482a3-e329-43b8-b83e-921c4e927870", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce23cbe1-c660-44bb-9b01-af0ea019c200", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0b50e26-e756-4228-9b16-75e9b9453852", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--117560c6-957f-4309-9220-e919002f323a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6958a55-6feb-42e0-8dce-aba359d29633", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a25d67b6-2d7c-4f0b-a7a3-7a04fdb570a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c8eeba4-06b0-4a5f-bc83-a6e948f28c25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b57dfd6-2997-4faf-b2bc-d16650e7007b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d719ebd1-26fb-4894-a86f-ec9d2bced6e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16b8bc1-7b3a-42ee-bb16-ce18b0f0229d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab48d625-b6c3-44a7-92e1-c0afbf2826e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--087be6f9-0155-4017-a96e-d4b9a11b7f88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad61141f-1599-47a2-973b-551157b2166b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b678a549-cc3b-4704-bccc-3c1fb1eb6f2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef134f6a-a238-4431-9525-beedb4fb2c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad599015-5d3d-4492-a24e-a9ff830213eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33c656e5-4cb1-47a9-a930-b9c4efb153d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced461db-1c0e-4fa1-9349-4738d511e1ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b134dae2-dcf4-48fe-a258-097409983af9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02eaaa9b-ea60-41c6-b294-25fccb25d174", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--281f5ff8-18a2-40a2-972f-c129122e4697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3816a770-359f-4e65-ad1a-30833dd3982e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53606745-fcb7-4305-9868-8edfea4308b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8db713d-cb3f-4c32-bf71-8c61004a2116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eeb53a3-aaaf-422b-ad40-3638f18759de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--921f5319-115a-4c73-9a3c-e99421e4c8a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a5e3155-a55e-40b8-bdd3-90a574fe498e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6024b66f-0900-4b1b-8861-a1f5521d8088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f3daab8-0138-4b89-909a-ae6c261b0075", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0053373e-d798-4cf5-97a5-5bbfd9f2df6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9b54e5e-0715-4b99-99ef-8eba332881d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a75e1224-2634-428a-8fa5-6ca0a44c1ec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d814afa0-f773-4ba2-a164-cc211a888ca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1cd22a9-9498-44bc-965e-fdbb51d05a7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf56cfa-900e-4dad-862c-92520328379f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd7b5bd2-0821-4bc4-ba0b-d649847dcddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4100faae-6f9e-4784-b2fd-d7f2118a2e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48eb42c-250a-4292-b76e-57fd389bcd3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5be533a1-69f7-4348-889b-5072ccc0e0c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157d6423-9bf4-4fc4-9e71-12e5d27082a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1aab990c-079b-41d5-b4cf-a48882f2bb6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc4028f7-ddb0-4413-ae02-5ad77d25e509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e39b796d-54f6-4347-b951-9fd6056b24e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab718de9-d9a9-469f-9be5-e53ef36c2654", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01c275d3-377d-4383-ae75-b4925c40f77b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.244.183.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cedea6e6-2251-4a13-9cdb-ff8f9edc871f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.81.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2988b06-5936-4ad9-b0b4-aabef7e84d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.85.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7590675e-ddda-4322-b90d-ee466f161414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.91.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deaac993-cc43-48ec-a01c-84816e81217e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.253.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13f444f-41b1-42c8-9ee3-65fcc3a50c80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.50.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6986931d-2bae-4496-b036-423ade09f426", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.56.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17785292-cb66-4df7-aae0-c836ca39778e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.58.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78249e93-13a0-4c13-8c78-70ee19cca49d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.60.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa767fae-eb92-41b2-a2f3-a0bf41fd5d30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.127.60.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--862be180-5672-41eb-9f95-173306a93cbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.127.62.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33fb819-0a4c-4536-86d8-13a72703a22d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.244.88.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4efca687-609e-4673-8573-4c2fc18152c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.244.88.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d139e204-9f81-4d07-81af-719209f80697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.30.231.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--806c6118-2540-4c4e-88d0-afed691bdc92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe0da30b-dd5d-4b3a-a9c8-6828184efb5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bbde6ac-e996-41a6-96a3-aa02a6688000", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ee62dd2-d205-4dc4-80c9-4eebe447532e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea381004-dcb2-4060-a6d1-8be46a8bbc0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c85f7ec4-2ba7-4e90-89db-9f4492c771d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46bcda87-d734-44c2-be7f-9842ca517e99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5537787c-75af-4cc9-9990-f673bf6a8bb5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SIP activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61bc3058-e511-4b2e-ba8b-68d2e9f2b67d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ca4fa6d-e0d8-42f0-8660-558934804cac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f40d53f-5f0d-4271-9106-24202cd0e4d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c5ccba-8dfa-4565-9107-50da36a35960", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09dbfada-d9e8-4ce5-9469-2844bd82d936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e399f1a-d421-4ee4-94df-f5d2cfd1ebf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3539a89-1e6c-4231-b75f-8b260e8b23c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fbb392e-b595-49eb-88eb-054a3ca4a8c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4a2efc4-7453-4052-9072-5ccc1db387d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b2e7040-bd9c-4e2a-8904-759d87ad4362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6648363-247b-43c3-96f6-2f03104d7a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c393dc80-2173-4dc8-b40c-9c6273861dc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c133fbdc-8eb2-4618-bba6-b9c7821dbd7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c05e254-52eb-4d61-8699-cda8fae101f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d05ecbe2-01e6-4a70-86d2-5a2948f272b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f85f0c79-2256-43a4-b718-ba46d55ae4a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b26d678-b5ab-41fb-8be5-2f3fba8a95fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f240f0e-af67-4967-bad7-383961841d19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--320081bf-91c9-4e7e-9a58-16e9ea2225b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--264a5daf-5f5b-43f0-86f7-8cb82efa1cf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.15.172.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a15b9710-1fef-41a5-9a7d-8004ae5241ea", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.159.130.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dd9ce41-b831-4bce-b1fe-860aa51cd20b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.209.155.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44e3d528-7c51-4794-bd0a-73bcbbbe0844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.26.252.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce7051e-af1c-45a4-9d98-baa0c38f681a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.26.252.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba49248-b1ff-47bf-a8c2-1c2f00cac2ad", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.27.20.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b20f112-caba-4986-bb41-7682c59aadb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.27.21.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54729277-2bbe-4a06-94ed-7fbfee89cc7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.56.30.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8de29e6-2658-4336-9e51-266e76c9ec42", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7d083e-a72d-4586-814d-5b8374accc2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.58.56.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c5646a3-e2e2-4b7a-9eef-847c3808c0f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.59.21.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df25f89-4b83-42ba-987b-d688e29f7f90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.59.22.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e2a3127-a274-4b9b-aa74-9cada1282955", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.63.211.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f0f792f-dcc4-40d0-a0fa-b745973073af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.117.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d096aaef-3b76-4ccb-8be7-2b0aa06d2fab", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.17.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4b77ab5-1dbf-482f-8ad6-03bec9a1e7a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.186.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f7374fb-374e-4b4b-8787-c59b35e219e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.186.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a09a54d-cbab-4712-bb7e-b67f4a0a67bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.206.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f4ce3c-2d8d-4231-91a3-4d829f8f6054", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.32.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac85bce3-b11a-4508-a703-6e54a86e469d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.57.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fabef1a9-75a7-40f4-b1d7-122a57e61bba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.201.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9749eeb6-f779-492b-98a7-9f2a825105f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.209.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796a3363-dc94-4bb1-ae6b-0f8b01c68652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.209.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eab5d6f2-c6d2-4dd0-ae35-aab4f90e506e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.216.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32cd1491-d7a1-4660-b425-54fec1007190", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.216.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6def8efa-1a8d-4135-a3a0-a5a4a6d502fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.227.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca366b26-9634-49c0-9c2e-c03b311bb6a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.232.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33fef1ef-d090-4d7b-a5e8-5e8962255efc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.119.75.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36082a88-c0b4-4136-a587-9313e0e95c6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ffb4e6c-e352-45ec-be6f-4c75e673dc50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.121.123.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5aa55e9-501d-47af-9fd0-2a91ce1b28f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.121.139.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f6e178-facb-4a59-9e5d-18aba7590035", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.185.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8986ab1-e34f-4301-b6b2-2a927d31654f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.187.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d73a8b68-bad0-4e44-af86-782a220570da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.200.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d46a2ec-169a-4162-849a-dc139ca780c3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.13.164.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a8aa87d-28ee-43f7-9534-1db2537a7d6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.72.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac03bd7-e8ba-4e36-b280-dad3f4116390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed8dcfb-668c-4455-a46d-fe1dc43b5c39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fc02011-f405-4490-a991-9f98258c1ff3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.162.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e1252b8-4bba-4501-97a0-29c4f48f986d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.162.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9645acad-01a3-4a63-9d6e-0b806cc143bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.224.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1387004e-2aa4-422f-800c-194d47679227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.193.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1bb41dd-2c1c-4e26-a0d9-60db4703874d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.194.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a018ba5b-b120-49d1-8605-1842c2edbb27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.195.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d046d3-45cb-47b9-901e-2bc06258e424", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.151.131.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7e6d8d8-1559-4358-a228-78f1b5f012f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11710bf4-f2bd-40c9-9f71-b3d29220ad85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f751f17-5b91-480f-9591-17ee5854d7f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28d6db3-923a-412f-b27e-766ce0acc3bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e0ee463-b3da-40a6-b49a-f414128955c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--267374f8-c508-4b42-8c3b-1677319fac29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15ef1fb5-882e-48a1-ac07-764c6b0ee945", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba377cc5-bea9-4eac-a492-68fbab4da1b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.2.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f76924f-2d02-407b-9d20-860405a37ba3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.32.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bc9cfb3-aa11-4541-aa49-3f18f7e9b4d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.32.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afa20b65-b43e-4893-8679-88877ae498d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.38.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb6a4a7-0613-4d34-b096-3410a3e91666", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.39.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c07f2e-6db8-4238-91de-e3d08ceedf69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.4.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bf0e489-659b-4877-bf38-9b4cf37647c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.60.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9855818-6d1a-48dd-a64a-b354ef699a50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b25d05-d337-4cee-977e-4bb929f8eb2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f8f9ab6-b2ad-48af-8f8e-2db5450ba462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.12.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2157e4b0-4f8a-4477-ab2a-aa36ba1084d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61823c12-b46c-4d9e-b4f5-0a1a2792a595", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e0be64e-4728-4468-8da9-56fb05b6369e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7091928a-6364-4998-ab48-ef16be6c367f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e49b844-36f3-4965-94ea-4a9f344c461a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec184d09-9a91-4cbc-bbc5-da9ecb7b518e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.123.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--036eaf3a-2e28-4e3c-abf3-8c6f27522410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.127.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd9fe8f0-a93b-4e83-a52a-b56f8ccaa91c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.13.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8992fb9e-1c01-4b00-a030-8ca7f42b2c9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.6.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cfc27dc-55e8-4246-9ba5-e6baca93335d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--861b0244-64e6-4277-9e11-fbfcd32cf937", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97156450-1b1f-46b2-9cdc-d1f44bf68fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.104.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0145f951-9098-4ee2-b0a3-17b79d79dbee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf6da018-fc68-4f6a-a56e-f2424a47c8d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040bf47c-771e-405e-ad1e-674789f2d39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee336df9-ab8b-4137-8dde-14bdc8e933db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--988dbdeb-3abe-4a71-ac4e-3bb1ae01fdd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--634910c1-5f98-42c2-b6c2-08f70fd46631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a41fecc1-600b-4a14-90d9-76efc70e1caa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb1a1814-9cc4-476c-85c1-634283057e4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.48.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469b1423-2639-4b2d-a4e9-2be0755e72f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.25.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--844b0127-576f-4d90-b90a-4bbc2e0b01ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1a21648-7f9f-4c36-94a2-4ba6b67f3710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b895fdb-ecce-4054-a754-da10187f9680", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69830142-c8bc-4e5c-ae2a-615e31904115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--094defe1-490e-42ec-82f4-4364ccbcd983", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6956dca6-4748-4fab-9178-a2fb9ff084a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.9.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0f0bb9-9a8a-4fbe-85d8-b354a13914a8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.173.116.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdb0e73c-a4bb-4c6e-8346-26aa62127224", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.203.42.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2012481-40e0-4f4e-9843-30c87f1d6d2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.58.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae2dce03-c8dd-4f25-a3e9-19c4a5793fab", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.244.18.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6593803e-9ee3-4e95-80a3-c409f612ed89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.21.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ede5056-f0ad-45e5-bd6a-e541c36400f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.21.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36fc0efc-c704-4185-b5f4-8f77b856c0e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4350272-5863-4a1f-8e28-54aa78166cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76d48bc1-f71c-4a22-95d6-67ff5193fc80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.24.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a89bbecb-76ae-43aa-a0e9-a9d8c00186eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.56.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b8f1391-e205-496c-9197-e974cf9923ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.37.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a39d5f4-112c-4d70-a472-0c22937fb91f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.218.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98bbb3f9-5b11-47c5-8296-f2778acc72b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.250.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d055754-d86a-4eb9-b131-52e16b179e72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.226.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6f4495-fee1-4f48-a7ab-fca3f9278bd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.235.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c962c5f6-bdad-4f8d-8013-6cb3122adf78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.36.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--311c5f64-dddd-45f4-ae83-83a706cd9e67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.42.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c36d750b-b383-405f-a158-edb1047db43e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.84.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--087b810a-e5a3-465a-a404-bc41a617ba02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.88.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02e4b8eb-8216-4c88-aaba-588158306470", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.98.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da92dbeb-75cd-45ed-8aea-4969af735936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b1f1cf-c3f3-4650-8523-dbe29140592f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--444a4a1c-1d18-42d3-ab0f-1a30b6fc23c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1ca20c-52e9-433c-aef3-0f95d21cfd57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c5ac934-c36e-4da0-9882-557c31d54f39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb757400-d5aa-4be6-ab7c-6ba5151a5bf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--321bc0f1-cbba-4bfd-8f88-451f77b4d30c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e669074c-2012-4b7d-b38c-1e8ab4a691b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69eae11c-00b3-4a89-b0a4-e8e8dfe0269b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f259ebc8-d33f-4508-9165-3d0506fbe59e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5519fe0c-0e89-41db-ab5d-9b26a2d0904d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b35445a5-4669-4275-804c-45c6d01edb57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78cb3d8f-de4b-405d-b87a-6949f97003a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.137.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ae1558-cb02-431d-aa51-679436652c15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.138.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9bc18b-cb6e-4b6d-81bc-39ebac88ee81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.152.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d9b37c-2bb0-4a54-8559-5df055a75df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455a1dae-8eb4-4a0a-8d14-cf4c7f5c4049", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.168.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f15aad3-8d0d-4c24-95f2-61536cb4e776", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.177.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214c2951-11f2-43dd-8ea2-6a3b140d6eb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.185.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0191bf3-a0db-4392-b7ab-2c73a98e1405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.185.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c326fe06-8804-4e1b-a8da-e580c6362d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4cc7d5c-cec7-45fd-b3ad-fd0f5d58dfbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12fd95e-63b8-4625-8e40-911239df50d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c80a813-d821-4713-a293-b30a410f6255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f531399-a3fe-49c7-b53e-698175cb156c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d5d5123-51dc-4f33-b0cb-4e4992b0872c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8105eba7-e74e-4590-a830-aa119979450f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0651ed6c-52b5-42a5-9aff-4ff37550d581", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ae748f-441c-4cce-8e51-03c1366b039c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--970f0680-723a-47b8-84e3-dc130eb374d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13ea332-477c-4ba0-9a23-b3b15050a50e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263fd5dc-6974-49e3-b29a-56adb4eaf08f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2802751-6026-499a-8371-0472401e8c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c7f175-910f-4970-b232-4f848f1babe0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b2ece32-47aa-403b-b0f8-be4a59176c4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74af9a8a-6d50-4e51-8d98-c80e6d0b53d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dd1f1db-f086-49a9-aa0a-8a4fced75203", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36ee49dd-f173-4178-99aa-59590ad71a67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ce76033-5d81-4282-89e2-9fde58f28fef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8bc09c3-113d-440c-abd5-0edea18ccd10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ed04f7-ab2d-4611-81aa-1a2dbffe92c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d80e827b-cab8-44da-a4d3-a222d2f0d568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db64e19c-d6ff-41cd-b5f2-ae88fc982fad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3053bfe6-efaa-46e2-95f9-e172b09a2275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--094d73d3-bcd5-4a6f-a291-3b353492edc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e983b45d-4417-423e-960e-d92327b9a6ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f91876e-c9b1-4e84-a20e-3b2c65c8e7d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54586b6b-8201-415f-a446-00edcd5aa425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e423ea83-dae2-46bd-9cc3-07aed329b22a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192ecb16-c955-455d-ace8-447df5d681d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--016bdd7c-5ee9-4b39-a2d4-2211b3138f9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--244df7e5-5370-4b62-b5fe-97d443fd0795", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035021bc-b331-4663-887e-fcf681ebf193", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.201.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f10871-a6c5-4d46-a627-159cbd88eda8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.202.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc0b9e1-bc5b-49cc-b2c9-8b61674c2860", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.72.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ec9e987-7036-43b0-ae07-1142ca05b5cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c2e3a77-2178-4cf5-98ba-31c07dbab7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e845cb-edf7-4025-a111-36ba902e2d36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.82.167.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c3588f-9b81-415a-9a34-7dc04bf7adcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.27.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70612d66-7f47-414a-aba8-3a0b8c0fa26c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.32.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd0470d5-7308-44a2-8d10-8eff10a0afd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.145.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff45381-fed1-47e2-8e3a-e797bc8ac305", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.152.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5520fec6-4782-4388-be42-cd6891d2ebc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.153.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df4ee3cd-4c2f-4ad8-9960-f06a2779af07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.58.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086eb3eb-55ad-457b-b8fb-7d5936d7e649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.153.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--071c91e5-9643-4f71-b8fe-5b3e0f81ee97", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.10.29.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0c4aaa9-25e9-4798-bbf4-5d5a05e2cbcb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.155.66.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--570655d8-d296-4d86-8177-70024fcfe3ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.26.188.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d332633d-b71a-4078-97fb-1d15ceb170e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.30.235.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8add0d5-7993-41ad-91a8-1e7b3dae3ae2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.75.134.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--111088da-8f0f-409f-a3fc-36520b4865bf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.77.172.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e852f8b-67d8-4e82-8e38-b93b882686f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.82.188.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0cd467d-0bef-4e22-84bf-7b4dbbc5c70c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.140.123.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--085a7b3f-fedb-4c79-b631-8f0e853f805c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.161.46.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6ded4b2-41bb-43cb-a081-59041de49199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.203.117.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f10a298-33af-4da6-85ff-b8279b6bd1a4", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.208.204.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d725eef3-e21b-406b-8406-2c17d193eeba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.76.120.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae61cb7a-9eb6-41f0-81ff-f6d847b1e9ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.237.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1a26e80-9980-431d-8671-77715243b755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.47.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea0db830-0924-4a2e-a1c3-72c09ba73164", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.53.94.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33068c75-3859-4cc0-85bf-dc1221543871", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.70.82.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf19795-c3c7-4a35-b893-c0ccbe3d6296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.71.141.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c5b192-185d-4e15-9440-b8b20cf4d201", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.76.176.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebc0e83e-821a-47c6-8ad5-8b7096676fc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.192.224.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0d3b9c9-702a-4674-9220-c1df57a4eeb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6a3070c-a338-41fa-a167-9e06bb88ed01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afcd79a6-18a9-440b-86d3-ddf2d7e40f7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93d729ee-7ee7-4a2f-a993-fb939a1187b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.83.11.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--624b5b93-b0a6-4a5b-ad72-9505047e6427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.48.28.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db42b23b-3cc7-48a2-b8d4-1f2d8c806661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--331b0dad-bbcb-469d-8348-011ffdb864f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.185.118.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c6045ad-6767-4880-bc41-d018b68bda07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81b31c8-24fd-48e0-b44a-7799d9cd481f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec795f5f-fdf2-494a-8f8d-2bc15f9d48f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7323a5ed-7b2f-4246-80b9-82b54671e1ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd503649-65ed-4562-a549-bde19460658a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--826b0d6a-8258-402b-b306-89b00c2fabac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c0719e4-1373-4f40-9fea-b04a50b5b63c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--958f5b60-f1e9-4e47-8359-a3381e31c352", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--920bb717-e2ba-4273-996c-6cfa3ff602ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51f7cf21-302a-446c-89c2-e99ed408906c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59ba2549-bf51-442a-98b2-20bde672f87a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e6ab7f-7383-4ac4-a689-95d46ed04b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56540852-41e1-4cb0-8fc6-d3202192d253", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5de969f7-9e92-4b3d-a98d-75988f3b7a2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4863e35c-5f14-4d67-9d59-db998db56a62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--432df78f-935d-4b67-af9c-cfe647c7ad56", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ff29ab6-bb3e-437c-b3aa-1de57b7a3ef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95440367-9650-4750-b9ba-4693e97003f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb79df2a-b915-4b4a-b407-7c18b5092caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--206ca867-84f1-4807-a414-1156f9a9b064", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39fe7aee-e9f7-486b-892c-a4f89c8850af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eab95f37-08ae-41aa-b269-0158718aabfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3801d9e5-26e3-4456-bcb3-38d08a9ba0a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288067aa-16f5-4b82-8f36-55571b539474", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da91afdc-acaf-4764-8c4a-59eeab3fe39f", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598c9674-b35c-476c-ac5d-d4f29da23e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c08d6faa-279a-4f52-b2a2-8afe220c7ee9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43818b21-861f-4eb3-b6e3-7237568fdf29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b63b27bb-8611-484c-bc85-60153c55dfcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--789d9907-7ee4-4f98-9006-01308ed0a410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fad2111-000d-4f8f-878f-a09881a957ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b0c7a8c-d26d-4dea-93f4-231ffd2d223c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53275931-8220-4071-9fc6-a3a50d77b85e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3dd64cd-6eb5-417b-8a86-d6f60ff4d659", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d27820cb-106d-43cd-bdae-1cfc869aa213", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3114b1f9-7a8e-453f-8a16-42ad73fb4436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f0a36c-bbfa-4448-b2d2-b315085d5e1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc2b2313-d208-426c-af08-062bd7bafdae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b7df2a8-bc74-491b-92f9-1ccb32944b76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18afe35d-d145-4278-9cca-a107da279abc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0559b6-28ce-4a04-8669-a15ea03b5f7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd612861-e6bc-4719-83c3-53f94306d3e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1b8bac-4417-4c2f-a5c9-5e8e0a941467", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5bb01d5-3608-4e05-aaf4-304cf4f65fc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4e08818-7d7d-42e6-beba-1afc2fbf515c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68275d33-6cd3-4689-8118-730951443268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1008257f-6cdb-4a68-9a48-52919b5abf71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f6d23c-0c4d-4691-8e82-6bc7d7ad8684", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c1564f5-711d-48b3-8283-85883afd0d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e607804e-426d-4a29-84f2-b645a4c59a98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81c7468b-ce6f-4546-bb95-0e71f9342b89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9e7f220-bf35-4e2c-9ea4-abfd4da25a13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7fc2b54-5840-48b5-93c5-4e50a1190be2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f94d5120-ba7a-4e7b-9f99-c9c41023289b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7567245-005a-40ae-b0a7-217e03dfd6c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05464b7e-63eb-45d7-8b3c-e71d79855b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b899f4dd-05cc-4702-b032-f66853373724", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d41dc0d4-eb68-4131-983c-19efa5517dd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ab1a9b1-c0b3-42e3-b314-7bb25198d9cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152285b4-7c1a-4e9c-a018-f3f1150b7338", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f1d7170-595b-4621-9487-8c732f081b41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--952b1405-9c13-474f-a432-57394b28a550", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc8878ff-4e53-4bcd-8cc3-b7852d434923", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ddf2d87-fe3f-46d5-a40b-eee183a2bae1", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4113307-9781-49b5-8c85-17cb0d60cc90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66288729-b828-460b-af31-dc41e0c103db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aac3dcac-5f50-4c14-8e6a-49e122846199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12731586-af65-4e77-a0bb-26f355badb6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c3cb718-b8dd-44b8-a03d-1ed2a0c9055d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf96c593-9dae-42ad-a266-088ca695559d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f753301-15f1-401b-8b93-112a600ad82d", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87815db5-f70d-4efa-9662-f0f0cba25952", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23b7e811-b0f7-44c9-ab37-a1c7e67dc4d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a9b97a-5f6f-4154-aa78-5286d342b721", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c318068d-eb0f-4b96-8f91-7645f4f56f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a8780e-1ec4-4303-a8f6-2aad396b6ad5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540cd9e9-1fa9-4881-947e-5b8aa137a4d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aafa8857-8d53-4b30-b484-c23d2d380d5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b056023-7ff4-4d1a-9b95-4bd16b141878", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6eab4cc-9017-4cf2-84ed-9dff6d5c7a1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.127.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64f7270-9ea6-42b3-9782-020fe9b5a3d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.141.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7014cfbc-28fb-4c41-9607-1fe3214c07be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.191.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63f55700-cc5d-4046-90e8-e574d5349cdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.206.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292e1fce-c271-49b3-a4f0-8da8846b0865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.207.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b90a0528-e5bb-47b5-8f86-33896e7aefd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.209.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd34d941-6777-43ce-b153-ae0ef5f71f4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.21.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b23ec19-533c-4439-a1bd-ac7b92898c3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.34.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d16457e5-f212-4351-8b1b-c3e149c1f54f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.62.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed2d2539-bdca-4992-99f7-cea636b94b66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.72.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab14f97d-d6ef-4eca-92bd-f12f26e0c371", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dd08493-95d9-4404-b139-1ffaf26450f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.81.9.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b8eafe6-29df-476a-9e31-8973fd494879", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.154.248.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5479fb4e-1dde-41eb-9048-ec747839fca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157bb697-bc2c-4cb8-ac23-1a9633e22ccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e09b4c2-7c27-4db3-bfff-6962642c14b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7007b5f4-4347-45e3-a346-78c8f2339f76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c913ba6-58f8-4a33-9548-ef3da7294378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca39746e-c016-41a0-a2e2-e8b429e76ef1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db908d33-2c63-454e-bb2f-bf5c49b3e7db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e761f31-6077-4d25-826e-e238df000d79", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.84.100.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b153558-04fd-44ad-9b75-0e883e5afe20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.241.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc1a9b71-b208-4e29-8f78-303a108fbc5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9897a496-2700-425a-91c9-fba89aaca978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1166760-115e-43b8-b14d-eda01c167ce2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.243.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--761f82f5-c9d7-4860-915e-b1233b36ff09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.243.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6b0b5b4-e2b6-4dc6-bef7-133c30ac1111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.33.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086fce74-fb84-4259-aa5c-99880b2797a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.45.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac20d51e-9b00-4684-97bd-3ffc9397f58e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.46.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de06b78-6bdb-4d7d-91a9-596afd200ff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.209.8.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f5b7d0-a1d1-4541-ad4e-e5dfa6a851d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.222.101.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d37defb-0600-4650-82e7-40cd919f7ee4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.201.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97e9b09b-bb50-453a-b721-e5582b730c39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.24.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ef6387-9cff-4fb0-b083-8b792b443805", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.94.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e0cc8f7-6a18-47ba-b3ff-6c74b4f3b254", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.96.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c02f3cbd-3b69-4be9-a60b-d1717bab83df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.50.49.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba6eac84-c4c4-4d0c-b181-d0ccb8954b6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.97.153.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--343ffc03-54fa-4b55-a0ad-bc50cadb18e4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.185.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40077c44-e5f2-41e7-a5de-7eb223f27554", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.188.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b68ee71-e9b1-4241-bef9-32a53b4eccd5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.16.168.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25196627-37e5-4efe-993b-78bb1e26d1d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.183.21.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71881f2a-289f-4fee-b092-8f771901b971", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.186.140.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b2d02d7-256f-491b-927f-889e454abb09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.206.8.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4ad87c4-2939-4503-930f-6c36ac54dc82", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.79.142.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--613e196f-2f0e-4fae-8981-e23dbfbd8a9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2019-5418, CVE-2021-41773, CVE-2021-42013. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.101.234.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--173ad835-61f7-47f8-9baa-64c68528fbce", "relationship_type": "indicates", "source_ref": "indicator--613e196f-2f0e-4fae-8981-e23dbfbd8a9a", "target_ref": "vulnerability--14d0df41-42dc-41e6-9ad3-08e6e237cf9a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62a4958e-4e98-497d-8107-33af024f67c3", "relationship_type": "indicates", "source_ref": "indicator--613e196f-2f0e-4fae-8981-e23dbfbd8a9a", "target_ref": "vulnerability--611c1a3c-aa7b-4f86-84c3-43bc23370cfc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6b03a83-82aa-44cd-8a1b-bb8e64f41fc4", "relationship_type": "indicates", "source_ref": "indicator--613e196f-2f0e-4fae-8981-e23dbfbd8a9a", "target_ref": "vulnerability--e38995d3-0612-4c44-8994-31701747295e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--471ea9f6-d83d-42c9-a2f2-05d2db9276d6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.105.129.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a0da0a-6841-4ecb-bda9-b9b826ab7660", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.170.168.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--219b2463-8c2e-46a8-9f3e-842425255747", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.178.247.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394f0820-01d5-4cc5-9d25-1916cff56fbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.180.105.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c0d5a6d-65b2-4ff9-9d22-438d00650ba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.22.223.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38e62702-cc06-4c53-9d2f-2b6c736e64ca", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.221.196.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80ca88be-6993-4583-a7b7-81721e6025cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.40.167.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7343fff-709a-4f55-9124-1e3b888fb0df", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.46.188.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1957fb84-0df8-4930-958a-45165712fa1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.47.66.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d287d48e-445a-43df-9ac2-de8caff72bfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.76.92.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173823c4-7ab1-4ba7-992c-6780a448a4d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.106.84.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b03244c-a51e-4352-855b-4918a6deaa4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.132.127.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b162376-d2f7-4350-a2b6-7668dd28eeab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.175.150.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40239e52-3931-4544-9ff2-150d3a2b03aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.192.240.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d15cf132-b758-4dd8-916a-02f04fed321e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.125.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8a17e73-7a82-487c-9641-0b78476c7e65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.30.36.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afdafd85-520a-4815-ba1c-8d5425aaf333", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.30.36.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2af9e3f-2daf-453d-80f2-0908689693b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.85.249.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f94277e8-1655-42ce-a64a-422659a12c12", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.109.226.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5f1e19-651c-4f65-8c3f-ca64512d7339", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.136.67.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06311e96-7bca-4786-9073-737c42c993cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.136.88.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b8aa3e1-35fa-41b6-ae95-3a49fdafe428", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.152.185.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--118a14aa-e356-4b85-88dc-641fcda2ebea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.155.206.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--236c69c4-f52c-4cb1-8a60-37efecb7be4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.166.84.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb1f6fc2-11d4-49e8-a780-f542cfedb3a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.183.63.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9315f9b3-9637-44e7-b759-8f92367ff33c", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1207946d-ddf8-4451-b392-de38f44275fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14d0aee1-b636-493f-95e3-8d90663ed99b", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08651289-e06e-4592-b5d0-675e876940bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c90ef75c-e3b6-4781-ab99-1a17dda17baa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.6.203.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18e464b-a476-4d74-993c-b836c0fc17dd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.172.190.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d78963f3-a4c6-4b94-8f8a-26a17ae49b2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf618a8-5554-408b-bcc1-833e1d172f7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--174b5680-9cc1-48fc-ba5d-f64a5598c227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a94214d-ed92-494b-8cbe-a777dd442ce1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37eb6c4a-bf65-4ae6-87fa-f67afadd1e9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f564ecf3-d76c-49ef-9e08-d6d68e1cea6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d73a3529-87a9-4621-8cf3-a2c6823d0a80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30f2046c-2e28-41a2-b60a-a659581f06a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f13a84-d2eb-4f7e-9e9a-5fcb4739a548", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30813f15-1be8-4686-9ddb-55a5a96854a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe7107e-527d-4ceb-9a90-59b214f0cc74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73b8f382-3b0a-44e5-87b4-6455c685acd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7d6728f-21a1-4c7a-974b-d85de4fbcb77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34432e22-3f68-4892-b39e-b37dff09fc61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2fd16d-5c88-4089-bd06-7c32aaef6cc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa82ff6e-0a92-4406-aba5-619bb0b3cd33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da1e0e6f-a393-4e9f-b57d-afab0e36d825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40bf84c1-ff60-489d-9f10-b6cdc32f265c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea615564-28ac-4dec-b5a2-301530777974", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64083fab-ab4e-41d1-af67-80641f4a5b72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1de552a9-08ae-4bd5-912f-a1fc1f01b9e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ff4837-9048-4d89-bbc2-efa831964363", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4aaf557-22da-406a-8599-fa3d2ca1a052", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5edca67-1593-4742-96d5-54a6e0fcf24f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04252243-65d6-4cfc-b077-e448d9f193a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8248f2f-6930-4fe4-a0ec-559bbdb0c90f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42527bb6-f039-42e4-b8cd-4e64878ed841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abfda40e-d5e8-44a5-abd0-af2e0ec63a5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eac14b1-b2f0-4c17-909b-517da5fa6a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc76cf0-841a-46fa-b3ed-04c7535d03fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8651be7c-e645-4123-aeed-6a2ec1c5d15c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b1d5f0-f856-46b9-a011-c601fdc048ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cf6e116-3988-489f-a246-3c0c95f9624b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e35189-5f82-4788-9bbc-4eaf46687957", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61399fa-857e-4511-8d55-fac9a9f75060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--415e13f4-2824-4183-96e5-910d81a7a85a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b5077c-69ce-4ef9-a2ed-863b9f58cfee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd41631e-535a-4207-8a94-8fbf9aca4ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4271029c-7521-40e9-8728-4c7b9593a58e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--405ac2bf-a4d3-49ad-bed8-2e685d88b284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f63558-03c9-476c-8a92-bc8072b3e71c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e36193f-5321-4ea8-b16e-c054ac98d65a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--099437da-019d-4333-a609-00f6e3164847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f8493b-64da-439c-805b-42585786ccfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a190d378-68bb-45e8-bac5-70b3756ab966", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ba131e-c6ce-4fef-a2a9-dd29504a30c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae7581ba-e4e4-475d-af2b-12509069cb19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8749331a-3c1c-4f71-ab73-d07b7621e3db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e79b4e-b47a-4fb8-bce1-5a650acdcc6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fa57680-1de4-4d8e-b4f1-41b0f10782a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbda70bc-9eb1-413b-9e88-f0512d73a43f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--929c26f8-c170-4ddb-b9c0-964498b5c766", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d58eeae-052b-4342-9493-abad24f058ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ea2084-7348-4248-80ec-64824cdfa3f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--876312db-875d-490e-939c-639ada9d135f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5181a423-0644-4c88-a698-a69870a861fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e76e940b-e604-4a43-9e6f-489bc9b0dfea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fd8dab9-dfb8-4199-ab03-719fc6110457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45826fa3-d837-4a28-bc8a-9d33245e2d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--666a97dd-cc55-484f-90fb-364625e1debb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b246cea0-16f8-4787-96a4-ed080f60d51e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc2379e-d496-483d-ad9a-b6bb6f757bfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.250.119.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27cb2bb-3ca0-4811-a9cf-e91f70e39851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.59.16.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--758d499a-17bc-4961-b7c6-7f23a3aec932", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7408b79b-0997-48eb-9137-074b87e2aebc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3aaa5fa-4058-4d1a-b123-c66c16f45cd8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.142.190.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639e3e34-e6b3-4d3a-b55d-847c6fb2711a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64f04304-9845-4b08-967b-603554268c4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e55c3f-35ef-4589-bc85-a9f161081e74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55826723-2a8a-49f8-8084-2621e49d3d15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.146.80.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--608fc8c6-0d9d-4f4c-97c7-25caeb0a6eb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.145.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341045e7-a8e5-49a3-b3fc-acfc4e4b4e6d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.154.42.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--535c47dd-8b09-4699-aafc-8c3ec8ab978c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.156.66.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fca442ce-c99d-41ef-b235-52c629b00e21", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.209.13.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28451920-ac97-400a-82d4-457ed7d71ced", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.23.12.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c81c485-9583-4907-beaf-02ae768cdba7", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.1.221.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71d1d97a-9453-4e4a-b669-5f29f786c7cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.154.181.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f10d22-97cf-41e7-bacd-9d85988586b7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.157.205.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cc06ce-3b96-43f7-938a-af65ac2fff1f", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.17.33.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5adc2e62-c17b-4991-baa5-f76e68999305", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.21.0.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09c56a41-3333-4e30-8024-6a418b7692fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.4.148.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0f6a24f-ecc1-40aa-a8dd-46caebbe1d16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.59.201.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d27e44cf-ae0a-4341-aab1-6cb53c24de87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.76.8.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fb0fbe7-b43f-4545-b964-24f8b5a3b51f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.78.63.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f974ef8c-7f58-4d11-894c-a3ef300d5f6f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.119.37.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5bd5648-8146-4279-88fb-42f857f501d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.135.118.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--432fd0be-08a3-4147-9559-337a87d57ef5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.233.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f67eb867-46ec-4dbd-b8d1-497d9c342e67", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cad2c222-3b32-4361-91e1-b3ac51c98065", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f799f04-782f-4ecd-b914-6c8c2194399f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f15997b-575d-4898-bb8a-23c5d9c3896b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.51.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62bb2af6-79e3-4050-bf2a-10a2a0d11713", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.197.78.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40d547bf-65b8-4f13-ae62-4c7dce65ac07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.249.15.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a85953a1-1e1f-45ed-a350-7859f4f03248", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.198.82.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae419e0-8733-4bae-b17b-5a64f94771d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.199.73.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8deb122-0b13-4684-9120-48e079d45db1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.207.34.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b3c194-91b1-4d7f-b2fc-776e67c651ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.224.189.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1267f994-e658-453b-91a0-33ba6583872a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.226.7.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5eeb423-4e8f-40d3-91e5-8fad233c1596", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.228.10.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4325bd6-3a34-4eb2-9b30-d869f38e546a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.100.70.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3de78abe-fb41-4b54-b87b-3ec14d0bdc0d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.110.147.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60444e10-337b-4c22-aa39-b07bb17b51c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.127.16.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217feb73-2917-44bc-b145-ade8b1d2fc73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.127.61.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f97310ae-0061-4394-bfd6-f52f8cc2dc4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.186.13.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d8ebc2-63e5-4d96-9ed0-f61ac51a9775", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.71.205.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae74a084-e8f2-4180-a11a-9384efc54c64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.166.22.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d25cb624-333f-4a2d-97dd-eb2a96ba7ff2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.233.87.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759128f3-5b81-4049-b67b-19531c5abd33", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.27.17.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7428059f-ac8d-4fff-ba57-7bb79cc03d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.68.7.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65d088da-24bb-43ed-a556-ed7a29285ed1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.85.103.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92fcb14c-7377-4fbe-a89a-ed11c68bc40d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.99.169.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4336c3-1d9f-4879-bb1a-9637f282a73b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.131.184.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--985dc409-1571-4ed4-8ef0-fa9de23ce6f5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.149.116.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6a91b2a-8902-4dfd-8452-b7612ccbf45b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.227.147.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca48025c-2710-41e3-b7a9-b2d462785d11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.237.188.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e32d42e-1b19-4a51-a327-5e877069c5d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.4.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95d09e52-bc53-4cff-8ee8-d8fd9626b4b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.251.136.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87a349eb-acc7-4ed8-971f-ad87691a8773", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.251.139.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26cf66a2-ae99-4d39-ae28-de51d816bcc5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.27.145.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cadf5029-6d14-4a63-a710-39f8e0be7091", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.91.97.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a8c3d81-68fd-4819-a10c-dcef3007c9a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df2b7c25-5ddf-41a5-bd71-18792f684281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--389db86f-d394-405d-9f0d-b313ab113f04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.93.227.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db9ca23e-ba4d-49a8-b39c-ef1b7bf6fb97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.95.20.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6140b08-8880-4e4e-93af-79cbe65a7b0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.84.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ee26aa-8887-487a-8bee-040893d0f437", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.111.32.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84bd1545-e6d1-451f-a762-fef3ad550581", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.124.95.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2960a71-0f8a-493d-84e3-2db72eb7ed44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.37.111.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d95969-76c8-4453-901e-a99bf78ae23d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.65.253.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a082d53e-d484-4f01-9562-6ed38e70f997", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.40.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402d785d-b0ce-4068-a3d2-ca42bac085b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.41.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9090e5c-a029-4b21-a940-4e145d561439", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.5.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a5570b8-fd15-42ca-a3a3-de0c113d4231", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360b:1cdb:b159:61c2:924e:8165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7fed5f9-a103-48f0-8b8c-6ce6b4575a53", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360b:2eef:ec54:de09:7a70:6647']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80eabf92-e047-4add-bb33-2c18a0457c7b", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:360b:c5dd:6619:f138:3494:9214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d89d3e4b-df8c-4ad0-9d8d-56fe99d6e59a", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:3624:465c:f1d5:a811:1245:7152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab16cab2-6458-4497-8248-a6c3ef198cd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.129.187.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5280fb8f-5d76-409c-b564-e6fbde0ba8d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.129.71.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c00ef7af-80bc-4d7a-bcb3-553cc6675f09", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.130.168.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83be64b7-4b07-4c5b-9f37-aa1a3275b466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.220.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3372a415-98a6-4a5a-aa01-43041094687e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.24.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64461d40-4fb2-48d7-b8ba-54f13492c72a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.139.62.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b944ae-9fe3-4a0e-82b4-7c479b2bb903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.142.170.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74e984f7-c9ac-49df-9062-2174d47367d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.145.106.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83b7ac34-aa00-44b6-b052-408f0be527af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.151.194.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aea3e42-6076-4365-957f-e22863c3fd03", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.17.159.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e841c0c7-6051-4334-ba93-781f97088c84", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.22.168.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--949431e6-318f-4198-9f4e-20618a8e9baa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.74.234.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2807ca2-1731-4781-aabd-a0449ae3fa23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.106.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2814c59-4570-4831-92ab-c5e128085c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.245.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf5c8bcf-842b-449c-883e-d50fd969cdb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.84.29.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59d53248-a697-447f-9985-699258c6bbcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.89.103.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52aacf5a-b180-4ba4-b8d2-089d57744e3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.93.193.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da666e51-e1c8-4d58-9a0f-bd1dab880082", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.13.223.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--599f1bd2-c444-4045-8deb-00c8fe56c589", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd392572-7736-40b4-9b2e-e112f2797b7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f1fc813-bdd9-41aa-bb33-34349b559447", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e17dd8bd-76e8-472b-852d-13fe06fb02e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.254.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5ab33bc-c80c-407b-854e-441f41620ee8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.32.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c73b5457-bae0-4b80-8cd3-620312280b23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.14.32.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00d68712-6f9a-4ff8-a7d9-b347a7234ee1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.148.99.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10ce28bc-c376-4252-8439-11e7be9e00ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.169.127.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d5af20e-e9ce-491c-abd0-d6962db91a89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.223.41.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c7d6530-971b-400c-bff0-739b6710f2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.209.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84b34cfb-6558-4c80-90e2-c9098c4de214", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.59.118.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f69cffd4-2fda-40a3-96ef-f21fe706d672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.219.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--593739bd-7172-4a7d-8896-ca9bceea63d6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.121.14.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ed8c94b-b173-4c15-a4f3-d982388590c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.125.197.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93fe9e14-c8a3-4c63-8a66-5a6a90a7162c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.107.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22aee456-b02f-445c-96be-2de07adde525", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.219.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22348361-9c1b-48d9-b6d8-a8f27e28a227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.52.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87b94073-c427-4e3d-a7ba-c2d876c26ff0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.131.159.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2056a8c1-1154-4acc-87af-0c220df9cd1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.135.236.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2952f083-c15b-46de-bd9c-ecaefe3eded5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.21.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04bfe87-b3ba-48b1-9bb8-df97ad267ec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.33.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed9fe303-6332-440d-b4d5-57dfbacd8b9d", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.129.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b94383e-c26d-4ef4-9f54-127191525245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.175.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdd12224-76ab-4fab-acbb-b129bf247822", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.189.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ceb2b66-f954-4e59-8295-02b3d5a0fe3c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.69.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aa0eeab-e9a1-4bba-a105-04c0b6908e7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.120.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67e084bf-fab5-42ae-a92f-cd8a9302007e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.126.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef25aa51-7375-4967-b00e-bbfe9bda8eff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.18.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c10eee9-39f7-48aa-8656-600fe5e7c8dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.28.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b09d5b-7954-45dd-a678-30339dc011b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.35.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--910e5e3e-c79e-412b-8acf-a9e848488eb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.162.18.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffd3411a-1512-4162-8db8-ad140b7184da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.209.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--202f7584-81aa-4d7a-a304-77e5cbf04f13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.186.128.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--474e0777-723a-49e0-b30c-29111dd7972d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.197.70.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb9d607-c293-4e69-8f5e-532977a25cc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.204.10.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d70a59c-8891-4f87-938b-0e52089913c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.208.194.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9f2a05-ae7c-4e70-92ca-c5b227097cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.228.104.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--151159b4-da08-4ea0-8bbb-a13ccb38f4fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.238.176.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204662df-d96e-4b9a-ad77-8e3f696f043c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.137.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d4c0eb-d1ce-43c3-8e20-f5282447ea74", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.145.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--869a0617-fb34-4a74-abd2-dec8d5a3fe99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.152.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ad38a8-aa16-4312-ab7e-960c2b277353", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.252.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6ddd01-1402-487a-a4ab-9f4ff105e89d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.60.204.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c78539a-084a-412e-bc7a-e2b2c6cd8dc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.226.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20cab1c3-d457-403b-a7e6-0e38b243b434", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.231.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--decab3c3-e0fe-40d5-ab72-164ccdebbe7d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.244.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b1fd94-c1d3-482b-9001-721756a2bcf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.41.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d89c3a-fcab-446c-87f1-464cda111014", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.64.251.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fda573a-0c9d-4f7b-887d-406d50312ec0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.72.208.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0efe9c3-214a-4648-adef-0e7470cb3ea3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.124.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39d5197e-73d8-4530-a464-b3d3269a3281", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.173.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43914aa9-1b3d-49d2-9f34-02f3e03aab6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.69.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33cbeeab-bf83-453e-9ce5-41e5b01e67e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.115.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5010713c-0c5f-4f1c-a6a9-98cd89e66b21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.196.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c53adb7-8316-4f1c-b68d-87602d4515e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.226.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6fcd535-a6d2-4152-9016-bfd3483faf72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.28.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb717679-29fa-46bc-801a-e30f8b21b9c4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.91.0.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a63ca40e-8d2b-4cf0-94f1-7c23426598dd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.95.197.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5de354fd-aa89-468d-9633-cb8479453a40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.96.202.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eae3cab-57c7-4380-8eb3-349dfd00721b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.195.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6298a2f5-da08-4cf4-bf94-bfc331db4241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.242.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30f589e1-3ae9-4801-9a49-8460ad6a39e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.44.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a23886b-426f-4a9c-af63-f92fe13aacfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.165.123.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--178fe9f0-d078-4d1a-bbbe-6d44f45725ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.169.206.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aac0561d-2340-4847-ae14-19e5957c6988", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.173.122.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79374542-9496-4cff-a101-aa5b9b2aed7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.32.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b927d134-61a3-411f-b116-4c9d00c228bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.43.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84193a46-895b-461e-a802-d9f63b670d3a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.188.112.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc21d172-8b9d-4e7f-afb0-52c3709ee208", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.226.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9437c52d-7a28-487e-bc26-272ae5e6040d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.244.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d808d1f-95fd-47a2-9b0e-91bd2e70dae2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.200.68.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--377b7440-d6ce-47f6-88c0-6718a18e4e79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20140924-52be-448d-97db-eee14d66d070", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c05067-8a89-401a-9db4-0d1b537b9477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64980efc-9e45-4d57-b7db-8ffaf60adf63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5655c358-cf4e-4500-aa90-a61750c75a65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4da0689-fc0b-4e0d-b407-0913a069a918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673e629e-bf73-449e-ae67-27d0ef5a4c92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cba0c3f-deeb-4006-a3b4-84a108c5d9e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cb92f92-fd31-4a1f-9b3e-a7e220e80f7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14133ed9-3b68-4d4c-b211-1d1e376c89d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--604f8da3-e28f-4877-84b9-aa5892afe025", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13503b0e-7100-4cd3-b1c7-05cc6f9bdb97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea60a12a-f1ba-48b8-afa1-dc54fe462ea3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e1838d-664b-474d-a37f-aad96212ce70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95fb4a8a-cb77-4d84-a233-d235c47900e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1d36a06-fe00-44f2-ac69-46b99e97e58b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1fb30f9-aaec-4998-befa-03815492a685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--209975b6-9be4-41f5-a768-494af4d0a457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40c94f85-d4ec-48d8-8618-474828364e23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e5487a-3ee0-4280-b3d1-3240d1d6a847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d2f4e3-46c9-4ec8-9d85-59675b135922", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fccd5407-ae0e-4d1f-b200-1086cb5fd425", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e40f2f90-b78c-40a9-b005-0ddce2f17d30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b90250a1-2ab2-4445-8785-2ab473c17f59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34efead0-460f-4782-9859-2fe99e0ec0c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18f36ad7-21f7-4cfd-8a2c-ca39259595b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f351d786-daf2-460f-985c-b3fb76c655ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c293a036-e717-42f5-a304-087739e912ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81a63e9-14b2-4976-b87a-58c736fcca1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0a11fa5-472a-47d9-b965-f79cc2b0dbf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37ecd574-f69e-491d-8048-f13b6e9d7edc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aad38c56-db2b-43f9-b907-e61f82c0e4a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c7ca684-afca-49ac-8df2-c0c7f4911ddc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--611a07ce-406f-4abc-957a-c185e9e4104e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34a386ae-7486-4e70-91ec-2a02ee10e423", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b3d07be-a2e4-4632-a0c3-3fce4b00094d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05fd53bf-dde4-4bef-b473-f002d1fcc6fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd8dd76-1efe-4d75-b5c9-833727eeec18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c42beef2-90c6-4a8f-b37d-f9f30c945e5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a828d91-2930-4fbe-b0ef-08141126509d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeb15dcb-1617-46c9-ae6a-39b12689b6f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42ae7952-5229-45d6-a1e8-4d839012c40c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--075fa10c-0747-4a6e-bbe2-6d4399b6d5fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07a5b2d-f76e-4a45-846b-d28f69fe67cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f154c3b-1b0a-494a-ac81-58af9e184ebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8426f8a-5f2c-4e0a-af2e-7aa4e79c1566", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48818cb0-d766-4c33-9ba7-c8071b2d7a76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb30408-c173-447b-a689-715dc1943356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a595b726-8b3f-4218-9173-2e300561cd62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8395f59f-3a70-41aa-b9f3-6b9663ddc5b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2afca9fd-3af4-41d2-87f9-926be9eba7b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51d9166a-a7d6-4dbc-ae19-0b65afde34b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7cdda2-cad7-4eeb-a906-936a23a1f09e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20306961-5622-4c61-bd3b-fb8f8cf0bcb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a81106-5456-4765-abd3-a0a07bc45cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--254c3ee5-e69f-426e-8bbe-3064e197f069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6992c20-f0bc-4fbf-948e-ebc998fa6fdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6d5ffc9-76bd-4e02-b53a-98b8f63a8a56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d5e092-3dd1-410b-bf30-cd2908ae8209", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b67ece35-74b0-4bfa-8c93-189704a5a2a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcd21ad4-05c7-46cb-87f1-e2adb8dac10e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31b7ee7e-eb2c-4520-94cd-d4c0856a2cff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea39062-b0f9-4221-b089-2b1d59a3f166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daaca6ec-b69f-410d-b442-e89033dbf95f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--702b5f15-1453-48a1-bff5-d1e99bbc9b5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3bd110c-933f-4194-abf9-401429c21e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82121541-7d6e-48c8-93c3-7b6792540754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--177783ac-d9db-4cf4-89fd-70fbe4c262dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--289f6cd7-7957-4980-a238-35178c66f79d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3514487e-f5f6-4907-acdb-6593057957c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a653faf-40e8-40c7-8a24-68568031080f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3309da4-8bc9-490e-895d-3064bb8b268c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--087d5d1e-5ce3-4aba-bd91-223e1d64ff67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b628f15-1a2a-4520-a0c2-40030584a45c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f78f2b-e293-4d85-adb8-ef7f8b124a79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e39fb055-6612-4c80-9b39-b065a65052f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff5882f-cb1b-43d4-b1de-9fec7dff1d2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92cf7cb7-8f29-4de9-bf03-4024a54b1ad3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe5475a-46ca-4af8-a459-18a7311ef2c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af14483-092c-4ff7-b12a-e37821c2fa31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ea1d8df-b2d9-44c8-b0c5-04f6b165c722", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11672e85-e7a2-4994-a6b5-210a460d8098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c972b5-d0eb-4e5c-9333-1ecdcae9d328", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fac5f3d4-f782-4cc0-8c46-d64bb9219383", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0acf6471-dd73-4c66-899c-da676c6b304b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--739963d3-36f4-4958-aa68-aee97f7dd0a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b121bdc9-b335-4c49-b218-d38321a10242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--335c453e-8d2c-441c-be28-c9f1dd34b7fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6a5f37d-f9e3-478a-9ddf-7d433d8c9f24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60fde42f-cf9c-4f2a-81d9-a462a5ba6abd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad7959e-46cd-4ada-a825-ea4d326938bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--302721d9-7bc2-4050-86a1-554a3dd7a21a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2de2e82c-82ab-4234-b2a9-ced79aa22a6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b27c43bd-f761-462f-b757-2607e9c96d71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192c9540-36e4-4d90-b68c-bc5a244477fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e89b93c-c83d-4510-a55c-39b321f83edd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f5e7c77-e030-4d62-a4f3-d811949a278d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16cde4de-e721-444b-9c53-aa910d6e6498", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54231a41-68d4-4fed-ac2a-22f2b895c2bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc547ab3-2976-4fcf-8465-2a254abdcf8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a4f1025-4fa3-4837-a76a-7184916c6d00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d659e16e-82a8-4493-b77b-13c01dd14a0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28320ddc-06d5-4fdd-bf6e-78af53ee43ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99348ddb-24e4-4ec9-972b-d40b4c90cb83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b42142f-9b53-4fdb-9f2a-66c01a265fbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78111f7-3197-48c6-8e71-5cf57eb51742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e51fcc1d-5e64-49e5-b5cd-6b1b3d6d690e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51312de8-eb54-4fdc-9f44-fcbf306fd836", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b21a982-1f75-4f9b-ba0f-7e04573cd1b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a385be6-264f-40f7-9420-65b4fc242ff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be483a87-4ba6-4064-a803-15f90709ca03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e728ed-85ad-4a41-8a7c-29131072b37f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20a797b9-1bbf-40b5-8681-b98deac269b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2956537b-6b3f-48ca-8f86-e2b652225b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2af8255f-a8fb-4004-88f8-ca2eea22d64d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1e1d4a4-d794-4099-acf5-36bf362aba3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18ec7de5-16df-44af-9d2c-fd7a432c86e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8f2474b-98ec-4998-8ebc-b0358c1f5d37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23a4072a-b33c-4339-ab6a-d88361bdd273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--990da301-c0f5-414a-8385-cabbb566a916", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ef7a0b5-09fa-417d-a3e1-c27bcee0e43d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4295ecd4-eb4d-4aa9-8efc-c47a1b658fed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f774feb3-d0b5-445b-be49-e8345c800609", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9209e99b-16dc-4648-84c2-dfaac463194e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd14d66-d8a6-4d9b-8f19-bd50b4544be0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bd8377a-e67e-41b5-b897-9dc212569882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f142c26c-b9cc-4664-9a38-039690371c0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea89c3d2-fcba-4843-8016-c6034368473c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a25fd57-b847-4304-8413-23593507f553", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1839f1b1-7303-44bf-9c37-d18e12beccf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391dfc66-54ea-4c51-8321-6c2fbc713aaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dd22969-9304-4022-a26e-141056834b02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b586e1b2-1e46-4401-8560-d7f44e4aa915", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b4cab50-ef4f-423d-a88a-f11d09fd4669", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88dcb5f6-46dc-4045-a2ae-8fef306b6380", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8672d9f6-10b5-4149-98a6-d3dd9503198c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--462b3900-0588-4344-b0a8-34f2c53e7812", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eacaa379-45fd-45c7-aabd-22389d6db09d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b30d517c-d593-4019-b9d1-6837e31a2ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--226865e4-b460-4c4e-95dc-c1978d506aca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--570946ed-9f89-4cac-a4db-dd25c011f78f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541d0d72-a330-4037-8b8c-015be81675b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d323f863-e75f-47bb-b7f4-5246c3876e22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b268fa-1a63-4e3f-ba06-138ac836361e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53fc52a-39a7-440f-b6fc-5d27f7696ab1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e6a2d6a-50c6-4e52-bf46-286f3e0a4e95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1110fd6-ccb1-4dcb-927a-25d35a4f4578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e036a4f-09af-4225-9d13-40a2cf062361", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a165c36d-db9f-4753-9bbb-74da07b73b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--458429bc-d462-4c54-8ef2-03864d05fde9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef4a1e39-6f64-41c8-a55f-959dbc65711f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ecbc374-8886-4087-b621-c87839343f70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59619ae4-5b9d-4278-a633-d9e942133220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8741a826-ee37-45ae-aa8e-984a826909f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ee5fa4b-105d-4a90-acce-affea240cba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c6af5f2-b9f7-4e7c-bdb5-44e0f5f5d20f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c6ac772-8c47-4ac3-8ad8-f4103cee6ea5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83a68ac7-4abd-4ba2-96fa-3b2f0376d022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4327a127-511e-47be-917a-61deb937a527", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6eebf38-49f5-4e27-ae17-3aa250db1d74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.145.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e67e9f-ca96-4b7e-95d5-eaa974281327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.205.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a299b239-94f2-409f-9dec-2d72a4db09b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.172.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6f769c-0600-451f-864f-fa7a9b8f4697", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.234.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0a953a2-12bf-4198-85fe-1d9b158e2fa8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.254.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4970120f-a2d8-4608-9aa0-1a10c92b566b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.237.18.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aff77cef-ed82-4249-a367-ece23454b446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.172.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f499b2a-3302-42a1-bb81-4c9f8e614736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.139.195.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9309af40-779f-4515-964c-a0567bbec840", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.139.7.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d39979d6-2891-4947-ad27-f2d4cff73a4d", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.140.10.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--678468d4-6716-40ba-8c15-0762a09bc5f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.22.112.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--550dce9c-1d70-4a2c-bab5-92d023440385", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.255.223.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b427f411-79be-4e07-acc9-c44672080398", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.69.144.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45d78c5f-fea4-4263-90c1-220018695928", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.85.191.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87e31679-4516-4358-85e7-356831c5a5dd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.88.136.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38d67ab7-b093-4ca7-bfb4-227a6e4f3267", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.91.81.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8747e4f-bbc4-47f1-b961-dcf2d1e5011a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.94.2.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f135e91-2d2d-46a8-9622-ed8e6c5a854d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d2a189-9bbd-4af7-931f-0ddb37b7b679", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e32cba93-8d74-4f24-9b7b-f2027b589f0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.10.113.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--780823ff-466e-4739-bd42-820114eae61e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.186.118.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b850d95-ae3d-4af3-919e-e43ccf5ee059", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.222.188.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccb5e00e-7ab2-4116-8e79-cfa99b23b2fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.230.113.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e84f51df-a9e9-41d2-9a54-41aee4c48db7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.238.63.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d56d3e0e-d288-483f-afd9-2c28e0215b84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.27.7.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd45fa01-b314-4163-8c7e-4f38a3a66905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.49.228.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616bd33d-54ec-401e-8051-05a4b8b3f445", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.133.213.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68b865e4-0c95-4b61-9f01-e01dd58479ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.137.47.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18cc414a-d9a8-47aa-b5dd-21b661ac1d21", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.180.137.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b9bb9f-2caa-426b-9da4-575673d5b044", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.224.144.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--577fad38-dcbb-48e6-b172-4b275e2c5a93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.224.144.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87121209-4df3-42ce-bea5-0a562dc07f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.52.132.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36260ec0-2cfe-4827-8d52-6a685d0b259c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.54.73.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e78fe09-6b35-44b1-9410-779ddbb339db", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.76.205.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40abd406-ab32-4fbd-a8a0-dc2b838ac18f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.96.178.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f577906-6871-45f2-885f-6ddf13a914e6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.104.22.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4e6d254-c06f-473a-86e4-922cf5de47e9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.125.93.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e80e6d99-00f5-4010-93f3-066482a7242b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.99.45.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd95bf75-49fc-4cfb-819d-7a6dbbdd0a33", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.182.219.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8947bd20-76dc-4776-83dc-4c54c21f33f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.210.177.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5b71ba1-478f-4154-a823-c9d9557ca8a4", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.211.84.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--712e9c4d-b45e-4fb6-8988-cb7331a94579", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.227.178.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20dd0300-dfa3-48b4-a8f5-d9dae24de77f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.168.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80fe35f3-4785-4a3f-811c-e74c2e27a125", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.171.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f5ee8a9-ccff-462c-8206-1220c1432438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.172.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b4620f-8378-4624-8256-351746b77672", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40da6a97-8e6a-4355-a763-7b5aa958406f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94eb3e37-1220-4b28-b2fa-58b2b281f57a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae6b640-527c-42a5-9450-b8edb1c8d476", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52f4141c-5514-42a7-a97a-3ff9dbdd8961", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d062251d-5571-4aaf-bad7-24f69bbe88cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87f6bb21-144e-427b-ad48-a29eddeae343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6190452-9135-45bb-8780-62792cd14710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c777204-bbfe-48ce-9deb-c5d7b373962b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f35be3f6-c672-4d6d-930e-800cef4d9827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--962a6cea-0ea3-4a6f-9f83-bf35c04f386e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.178.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a20da0a3-3908-41ae-aa87-d9850aa6136f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.183.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c79816-20b2-4129-8271-4565f5c302ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.185.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab53144c-2b0f-4b2b-8ba9-cfed1c2d83ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.185.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1025c634-3492-4011-a859-a8a123057fd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.74.208.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d475142b-a3ed-43d8-a016-4244910d7c12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.116.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5124d83-ed0b-4072-b934-921ff57f1afa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.248.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--332dec8f-c54b-4df8-ac7e-af4f03e2d077", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3e8604-1bcc-4e2e-85b1-41864282067e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb9a59e2-6266-432e-9429-e3d824297e4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e2390be-5f8d-4791-a2bb-4806d0c6babd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.81.230.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec86c81a-1a45-41f0-b17d-7db608b144ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.90.235.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720f5886-a199-40ff-9142-5bc293481e20", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.204.63.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd669c6b-b27c-4d12-b5b3-388de28c30cb", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.41.173.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f559ca1e-6d38-4e4c-b5d1-f8f6bf44ce7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.176.158.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d95f628-c051-4f23-a0b2-c997bad0df0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.4.62.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21de6bb9-a249-4137-b858-226184d886f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.48.38.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b836fc67-e9c0-428a-b6c1-7136b6dbc222", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.51.41.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7700189-73b7-486f-bda8-0f82a7d6c7c5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.100.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--514a6e9b-2898-4e23-87f9-4adcc6e9b474", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.110.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d7c57be-cc4c-4596-9449-391da78d7393", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.27.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812d93b8-c322-4891-a1bf-206d425f75b5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.28.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5edd165c-94fb-4526-b31a-8c8af8648196", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.31.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af2f81bb-3812-4cf6-ab3a-20aab6fc3202", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.35.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fb9da47-9db6-405f-86a4-bbe0af426c5c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.36.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f97c3e5-a6f4-4567-8e7c-61516552ab07", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.36.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02412edc-3417-4c41-a52c-032563847a9b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.61.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46fd26f8-6682-4a04-977f-f90b9d9767af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.72.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a41283d-b98f-4f86-b497-9aac10ab2e76", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.227.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d54fa54-3336-49c0-9253-fc297b83668b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.148.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55d8aaad-23ba-4688-95a1-c56a9866aacb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.1.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43b2ae07-c5bf-41de-9fb4-1bcb80827269", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.104.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a72c78b1-69f8-42b7-87a8-12587bd6de83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.111.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb7d65c-4f5e-452f-95d6-71323c9917fd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.120.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0315371a-0c8c-458a-a6c1-984c51beb614", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.142.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbebc017-9ff5-4835-818d-715d6b1241b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.162.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--888eb304-87d3-41d3-8183-5fddc9e5b79a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.174.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e58974ee-98a8-44d4-8373-963eedecdd53", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.177.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e7999bc-5183-4707-962e-54a1cad8d656", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.18.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d807f84-6ed4-418b-98f1-9e1f1d868676", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.182.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de8deade-2e33-4df4-b008-702770c3a4f7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.183.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--975a12af-21c3-4de7-8a6a-5c0e97289b8c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.236.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f9f150-f13a-4776-9686-c9c2cb5d321e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.35.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d23d846-3696-43b0-970b-b21c5c8fc491", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.38.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d3e0881-763e-4b55-be0b-43825faf9b33", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.46.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a58f5d7a-e6a6-4ecd-bbdd-e8c36e3f793c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.72.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ae6b827-7a8a-4936-b3b2-99deea7e4d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.9.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f45f5830-35b0-4dec-882f-8932ee4e0501", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.128.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e81d99-1e74-49a9-a756-5f063c534756", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.135.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d953b272-2c1d-43f0-b0f3-31d413158e39", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.142.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33d16b6-0a5a-45ef-8d5b-8ba47f1b9516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.145.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a71f5f4-e80d-4158-846a-5cebe5917fc0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.157.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c846c4-e5ae-434d-885f-32857fbfc5ef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.178.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a2f4001-7d18-481d-9867-c22043eb7069", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.211.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765f560f-9a98-47dd-addd-79c087e66a03", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.213.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b62c5029-a017-42e3-96b8-da88a94a155e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.138.68.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a992df4-0362-43a7-afa0-a0b361467ccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.142.87.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea535b8-d610-4172-81af-3ae54f3bfba1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.152.72.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7658b8d5-a8a3-4a1e-97b2-58fcf5c7adeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.152.72.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--633faee8-1c3f-4e2f-a842-d1623a296867", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.1.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--635813f0-7f8a-4e34-a661-84016c78f1f3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.107.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abb1d41a-89ad-45b9-88f7-2e714cbcd9e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.150.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec03b0da-5ae8-4f70-b5ea-f08d96ad08b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.207.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb3da8a-f477-4103-a0b4-256a55a2efa3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.21.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d91a986-9488-4aad-920f-4530450c408a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.213.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb7fb52e-6be9-4fc5-8d4e-6ee7d747fca6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.216.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71079bf-c709-4dea-bdde-c796a73fe45c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.22.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ee7ba88-727e-4381-9852-6cc7795f3f47", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.36.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd237cae-783e-41c0-885b-3677044df7e9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.38.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19665f6b-b413-47b5-87f8-57ba36a11531", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.43.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77367fa-e3c7-4d77-9832-352befd53d4e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.47.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad75d2d-a1f9-42d4-b20f-8dc240ee6d96", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.53.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf84c9b-1420-4874-b8a8-7dbf23ae2800", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.69.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd857fc6-aed2-4ce2-aa78-263058719520", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.70.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cb73e9b-b59d-4054-8f35-c84db7eac488", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.70.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd53810-56f1-4fab-a005-6d6719ef36cb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.93.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78d622a-74fd-4b07-89ed-bd58a988088e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.96.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc167fd2-4cb2-4826-88c9-603d97a99fab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.162.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e554f0c-54a0-443b-8147-b5bf9cca248d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.0.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e05141a-96f6-4f7a-80a7-5e979f63e3c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.202.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29036108-7398-4948-8b94-11872effca6c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.226.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9c5f868-a729-4645-a542-ec842cfed16b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.238.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233d4bd2-71cc-4132-9be0-47e2bd4df2e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.28.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89936b46-7834-4566-9df7-a9d4c695db78", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.40.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10046ec2-556d-4f12-b856-63b039924002", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.58.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b198e0e9-1733-4032-a8ad-d9ba1cec68f2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.97.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e0f58dc-dc72-47a7-ac73-4922672dd722", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.153.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caddef24-1447-4a3b-90df-a182f0f67734", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.179.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5281f1e-2d30-4644-b9ee-55d0f62df58f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.180.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24447245-b15e-419b-a08a-c81070f1f2b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.43.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23820242-aedf-40b6-ab8e-a6a46d789273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.158.91.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a9ecc82-0f2a-4ad8-b243-0681d1e3cf53", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.132.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ddc0241-9db3-4dc1-9031-dacf3ff76096", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.139.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c2702b8-cf67-4346-b520-05c20f24734b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.145.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5efb891-ca37-438d-be19-d10da51483f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.149.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ff061c-4b72-401d-8d0c-28f636fe9c8c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.170.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34c98b74-f96b-4f1c-9aa8-e3fa5a17f2e9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.1.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dec25c8-e918-4ec5-aca5-295586bc8803", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.206.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb485908-d878-4d62-a80c-096448f8c295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.6.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83b74a39-906c-4130-a000-1b6d63a1b389", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.88.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea35d243-28c4-4951-a84e-bc96520d2ba4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.96.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85cfd651-3a5f-4d95-86e6-dda483fad9cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.67.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8261ee07-64f5-488b-94ff-bc0fac64e4e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.226.186']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9699158b-7327-4cf1-9c34-8520a045c576", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f19dee0-4552-4cb2-815c-fc708ff7b536", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.195.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d71d7d10-03e2-482d-9c89-971511b16086", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.1.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c25d9c8-68a1-43a2-882f-b374a7609c05", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.125.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d65efaf1-0e82-4061-b137-d5517a6e36e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e64fe52-ea67-40b9-bc15-aa48a127019f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.177.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25e65bdd-9385-4aa1-b2e4-aed584fbe9ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5ad79a-2a91-4e61-9dc9-1a4d7dafb953", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.66.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db04415c-a053-41b3-bd63-a26e39ecff7a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.84.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de622ed4-a9af-4f76-a425-e23fb5ffff84", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.87.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0851475-d087-4056-8fcb-281932715494", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.91.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac23d9e4-d39b-45bb-909b-3ab7e86e63fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.224.0.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37aa0fa9-c9ff-4f7d-81ec-dbd46c555284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.224.126.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--495e6ca9-932c-4c31-8b5b-64dc869b9ff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c915e47b-22bf-4827-a564-2b9ebeca07fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5426d379-9918-4099-9f3a-a6717abd31ec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e304616f-b3b7-4dbb-bfa3-0cd173c472f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f22b1f0-b4b5-4214-a9d9-c9b987ce7374", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9474afc0-6eb1-461f-a671-b36db47af4f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--258344c7-1b56-4a7d-b9ec-90cc406cb861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b4ddc65-4509-4244-94b7-f8dd73f56f7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.103.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7df9e4e-efe9-45ac-98c4-3f25873d53bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.180.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2388a590-0983-4cf6-8032-53a5269c2de0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.211.45.255']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064c53c6-dc63-4203-a047-d83020937a53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.212.59.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7199f66a-1dfc-4350-8916-57bbdd52636f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.220.188.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d101581-9bce-4019-ba29-ef51979b4604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.10.165.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ea3965-6e4f-43c8-bd2a-84502107b20e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.112.149.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3565f9f0-ca7a-4b68-9ed5-eb2a3b6a494e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.119.212.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--974ca006-fdb2-4c3f-90e3-f97ce1cdc470", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.119.84.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65caa80f-50d5-4607-bb9f-d7e7d69f3c99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.131.46.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d2571f3-0c93-4c11-8fdd-a8dbbe67607c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6204a4de-83f4-454f-a015-441cad215e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b181f0c-4722-486f-94f9-f0e53e401b38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.136.6.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90514f64-627e-406e-b8ea-1c5517f6ec92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.139.122.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b28fbdb-3408-4418-9a73-ec29863bd4a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.141.233.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f588de98-7d65-49c0-bd3b-7248bd84eeef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73c4a877-7498-4595-a1de-ed816b39f1fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddea3f4e-fbba-4ef1-8f91-6a2dd64dc84f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e16dea-a7bd-435e-8981-f8116fe479fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2220138c-f9eb-45ba-85ca-965336070109", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d7ea662-c56b-41df-a715-6e77820ed32b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82227096-2340-4a7a-aeac-812b7038e786", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de3f0c00-b61f-46ca-b3c2-a11fce6d4c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ecaf4ad-ecf7-4fbe-9950-68ca2bc9f9f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce504f9-25d7-41da-b8f6-30d44e5fbbfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b399478-6534-4349-8fad-8f3fffa34c6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffaa9164-7291-4ce7-a676-c596b9187b42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fec39e5b-190f-4541-9528-b7ffeb56a2f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ced610d-8a5c-46fd-b335-61f68b7519ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--261aeb3c-21d6-45d8-b263-2829735271c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce7addc-2f60-4eb7-87bc-6b70d67e14ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d23115c9-f510-42d8-b8d9-39a17328db2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6289f90-b438-485c-a5ca-d876ed7d2a6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639bbbb7-39ec-4f76-a9cb-e0d8dec5812f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8951f7ff-850d-429f-9d0b-001a386fa63a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b89e2aca-cc3a-4b13-9bee-fd8608bab310", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b7eaba6-8b7f-47f8-aac8-86c34be248a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0f172ed-a5d0-47ee-b131-4169e705bc85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5dc2caa-8389-4eb5-9be9-ec63f13bfd94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aa7204f-1357-4993-843c-b4e0034e2b50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06bcb1d6-4bc6-4351-bdd2-156863fc59ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c4d662-7e07-4f95-95a5-ef161ef81b5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--683bf9f3-a5b9-4bf1-8ada-c6383e86bda9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.143.198.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26884f3d-19cc-4180-b835-0e1b539a9662", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.144.212.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90fac826-1994-40d6-85d5-a7a33e964f97", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.147.249.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27045105-3f54-49a1-b893-4dffcb82c5f8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534cd640-0154-4d06-8fd4-c2364db5a9e6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5e094d1-56a6-49b6-84bb-456dfdfc3ecb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07e8b819-ff9e-4bd1-be1d-b4af60792fcb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33a1c8b-2ff6-480f-8b0e-f8272c52a4f5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193fe15b-ecc9-4b9a-908b-4d765d8e0898", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c606e9-a424-45e2-8db1-1247c7c22169", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afb73f5d-ce50-4c54-9f5a-44a2374b7529", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.215']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c883710-6a34-4f78-9343-8bfcc5d8576a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97f1c1e0-bda0-4ce2-9cc8-397664c34e80", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7866df98-49e3-49a7-ad28-13b946b12e6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e37de1-4df0-4ec4-8e5f-4dc15e9d455f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.145.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--959c5397-241b-4963-82fe-23a7ca05f5bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.146.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccf59c3d-3d8c-4885-971c-2930ac891dc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.147.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356a6851-6d6d-4024-a1f6-afad4284aeac", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ac3767-71df-4aaf-9339-2dc058523d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b958522-4cc1-47ee-abe1-0877bbfb9ac6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fc41ea8-77b2-4b72-bf75-cf174249eaf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b879fde0-087a-4a64-9c13-7c1f48bb5c70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b638a62-22d7-4a61-9213-a968e42e979a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48c41872-6c1b-4dce-9378-56b32bea4a79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f6730a-f00c-4537-b6a0-1be23391b3d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--446fa394-85db-4555-9f48-93a374e6f75f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--943b6031-854a-4068-9de0-d13db08a4484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e21b7f67-721c-417d-b4e6-efa0bac7e54d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea583bf2-b00e-4e5b-92bf-18c8a06c7946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e49c0046-c4dc-4c92-80e5-ba9475de4eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68726f79-686f-4a01-9c0d-6e7f85ad3824", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be4383d2-c560-4d05-a136-9693dd41b5e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3004fe3-db73-43f3-978f-025b03c20146", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--386a7851-823b-4292-901e-12a8f3095b74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5061127-dcb3-4a39-9ca1-5a0df325e2ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--285f6340-3752-4e97-83cd-815b9b312749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6a72ecf-a66f-45fd-8a47-0bd69b5ccb3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5cb2f4-8e34-4284-9eae-b7d785375808", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cd2d0fb-c317-4776-a078-a039ffcc5324", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a48c5540-4f25-48de-9d23-0a8fc8f935a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56d838fb-b9b5-4c4a-8903-64f5ec9a0cf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b984fef0-0448-4e95-b40a-8b91e9fdd5e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69743aa7-5740-481d-8836-df49a99c3530", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4d4bf4a-9158-4ce8-8222-70f23118bb53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16352f6c-4105-4936-990f-a91f7625168a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--862b95cd-4b6b-46a2-b530-4eec37d7ab45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae24db47-2391-41e7-b00f-d815c743168f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b9c00d9-1bad-42b2-bb32-13c059a0bd08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6b86f28-06d5-4681-99cc-863695a6fab1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa8aaad7-ed4e-4e0f-8bb7-d72d410c9533", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89af576e-3581-47d5-b9b7-aa06f1a932b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6839f55e-f1ee-4647-a18e-6968fb67f9a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.174.72.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de168d7b-f6ae-4270-b1e8-6bc496aba292", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.216.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32628260-4620-41eb-ae6f-7b3e7a13a3ae", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.181.99.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7a7258b-f0d0-4599-8a51-65ce0192b05d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.186.208.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63896d7-7fdd-43ff-a350-2645eb619d36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.187.202.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b534e41-a827-4888-a22b-be7c9af7c84d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.188.123.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd99fb5-d00a-4ace-9e1a-a28162b7ed3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.14.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--627bf3c8-5fd4-4f98-89a8-2c2468fd0a83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56863f9f-d605-47ca-b9db-49ded1817905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--602830b1-a2b9-43f4-9ccb-159382a24610", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a5781c2-3432-41d9-8b7a-89be42e98d3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341530c0-e4aa-45e0-8eac-61215b6c5d9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a1de8d5-d75d-4d5d-a409-c1c6c71dc7db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b70ea9eb-a103-4b4c-bf0b-de3a09687927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2561a92-1db1-4c19-bfca-871d1b0b0220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d622bb31-44c3-4b3d-8952-d932b828859a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.202.247.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3683662a-6a76-47cc-81b8-f159bb26fa05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e197046e-ed04-4586-bca0-8793efde2bfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd8ab4a0-aa2d-4f00-bf21-30ceebce8557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0405e1f2-b846-495e-8b53-898a73982881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d698a7a3-ec1c-4017-b704-f7aaf47781b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.62.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64ac9e02-aab1-4aa9-a9bd-6c0e3ae9ccdc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.227.254.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--472f13b7-683a-42a6-9a33-0e0f520df3fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.246.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70dd276f-e1a2-4886-aef3-0a27b4d1e2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.252.188.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f06d6b0b-4b0b-4fff-842a-55373d2dea83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4a2f23-c7a8-49b6-8b9c-b186adff1a92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38b1126b-a40b-4904-a1ce-6ec4358b6946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3acdd25d-080a-4987-8374-406c9cdd9547", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83974f9a-06a3-42c2-89de-29c92811711f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.110.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4c00f0c-c667-4048-8180-dae981aa4757", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d398e70a-9978-48de-a8e6-1962a93c5f57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.14.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f512d694-381b-4369-95d8-024dde04ef52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.40.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f0c1160-34b5-4d18-a10d-34333debfdaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.41.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1476697b-3e59-4df2-8000-7a5a3da723eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.42.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--940386fc-232e-44c4-87d8-288535cb6aea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.52.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e920e795-26c6-4828-87ff-5dd9c94d0465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.70.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba983d20-6cf9-4f98-a51e-b2cf4081a256", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.78.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5afc956-3141-4be3-9a1c-4127e4b64105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.84.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f0fe1b9-627f-49f9-b7be-7bb2bf64b49d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.88.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e165964a-e372-4540-847b-0fad533d1e01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.89.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--305e356b-9a72-4a24-839f-93bf87c07792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.94.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca0e17e-e07c-4d3a-9a5d-d65e15e1ea0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.95.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed356805-238a-4ff6-ad46-24d3fe1d007b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.4.57.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89547c0f-aff0-4606-ab82-28ad92cd5406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1643e33d-54cb-4e08-947c-84a99eb969d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362d9bb1-b59b-4e8b-95ec-5b1c1c80a688", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.42.88.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aea81b6-cd0b-4550-9594-ad6ecbde2ae0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf586d02-14af-4e46-a329-3890b6fc5594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da64a52-24ce-4424-a640-16af676c097b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8538c566-f149-4aad-83bf-212892b93bb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--736882c3-4e40-43a1-9708-bb3928429916", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--782764f5-20bb-442f-b130-99f9ed2448af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c508ec6c-8e61-4ac0-8c36-08963d412843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.63.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed875142-5f03-4427-8bcd-387a90302dd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.5.102.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fda7e35-b32b-447e-a8db-016d63423903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.158.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecdcf468-5b69-411d-83ee-ec58c4228ea8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.185.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72affa20-a5e9-479b-8d02-c0858455d438", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.186.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a41b6f-a08a-405e-a01b-ab701cb79a76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.111.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af0df57-a216-4071-9fc8-1b5ec28856bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.118.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c1aa85-220d-49ec-b5a3-c529c110068a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.165.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae421a09-bcb8-4a44-b5ff-1c32eeb7e281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.79.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39815231-73d4-46fe-ab17-4391cf56303b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9a195ba-1dd4-4f78-9994-6265fe5a3ef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8f0d7a1-7ab4-4251-b294-86b3df92a8c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6546f093-480f-4502-837d-dcc9b10da819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.84.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d43534b1-aefc-499b-ae92-e0e9ec33bd45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.85.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3dc3fa-632d-4777-a734-7f33fcaac31f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.66.131.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3817211-c6ac-4ec5-b90c-1d01f906fd75", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.70.216.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b647b724-eb59-4fb5-8815-d0fbedb7adb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.104.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b91b4d89-c147-42f0-8f28-5d312f510dfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d0d6e61-98eb-4054-a452-6c04e5dcac27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12bddab4-1dc8-446c-81fd-e65f5068c2ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8c6228a-b562-49b0-b1c8-74874c1c7e7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3584dac2-3fd5-4d97-9fb6-7b15855a3ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.114.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89ed240a-6fe8-4658-8087-b4996ae23e0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.115.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e05bfae5-356a-4b62-8855-c8ce6ca8de3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.132.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581d85eb-84bb-45de-9808-9ec9496d0bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.150.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86fa439-4d47-4f84-87f3-021174bd84f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--589f6839-21b9-4227-bcc3-5e351cb6d2bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d7aded8-8fad-4b19-a9ee-751f3c5c081c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.163.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--867b8f25-c7d0-4525-9d8e-7f26ab4f43ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.168.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e13e3d8a-6321-4913-bd57-afcc6f962232", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.172.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce9bf9c-8d9f-481f-9b46-78ac6e9d4bde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.177.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--834ae1c8-6925-4659-b544-78a1ee6975f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.181.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3284451f-f6c5-4d02-8589-6962d88f5951", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.186.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cedd7181-b0a4-4bee-bea2-b4cd48522287", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.191.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b08dab90-2c0e-48bc-885d-5e2615dc171f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.192.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82cedbb0-a797-4f76-8eb5-879441d403ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb47b53-b226-48a5-b059-631f756fb08f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f134e95b-3707-4a4b-9fa9-1caf08a1cc02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.222.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d31b1e16-bc99-4b6b-a472-ea9a75d585b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.225.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d313cbf2-d51c-4155-8502-013192bb37cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.40.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea36509-6602-47fc-91ab-2f7edf09230f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.7.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef69bb95-0c2f-4782-8b5f-de48bfd800ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.82.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700c4a06-37e4-4a95-b9f6-1e04ee9d2c40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.92.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06c8350b-9b97-49c1-992e-66f6ab30438a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.98.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96d8f613-1e8c-4524-bb31-ab717e8e3d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f250fdbc-352b-4e38-9126-42daa01db509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.94.31.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9437df0-61f9-47ed-907e-d47ef830844a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.137.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b127fb9-c874-4c16-b314-ec7e5da956a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.244.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--787ca025-3a95-4f59-b19c-4cb11a011112", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.105.132.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81961dd4-da57-46f5-8308-0e407d9e223b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.105.132.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a39c4a9-9294-4ee6-8881-2c70f2730e13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.107.215.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4bdee1-441c-4e94-8e7a-72b4f13d905a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.116.140.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455bb0d9-77d8-487c-8ec6-20376b2a2652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.146.234.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62c3f94b-c7ba-4fd1-86f2-227e29047162", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.149.191.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1980fd1e-eb92-4496-8eec-7a7302fa35b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.178.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b597d51a-be53-4da1-aa88-45a986b4aef8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.182.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f40eb3b-c25a-4c49-bf8a-58a3c97b6521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.62.239.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ea5a77-60dd-487c-a31d-242e002285fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.8.31.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dc9257d-6923-4044-8631-821717e3bb0b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.112.16.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--714e1f1d-da0c-41dd-9f12-5ecf39b39855", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.113.149.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0bf3fad-a5c9-4804-8305-fe411297813f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1bd6360-3c5d-41bf-aed5-2079a5faedc5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41528975-848c-4d29-9220-fabf1af4ab37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.154.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77115ba4-27a0-4fb1-802e-c6daedfa3307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.203.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2457fa92-fcef-40d9-853a-bb10378052a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.206.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0eb2c7e-82a2-45dd-8ec5-75cfefc97395", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.169.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f051e922-7490-4ef0-bee0-69e39b1ed929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.193.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29bac3b4-423a-4281-8fd6-1330c7f3e545", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.195.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17956ae-8177-4b63-87b4-2421fac05dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.200.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cee465a-f65d-4449-b75d-01a1086f8b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.223.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a964936b-2ee8-4bfa-b0b9-2c8f5e8b3283", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.113.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a80480-235f-40f9-86e4-6dc5852da291", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.128.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e302509a-caef-447f-9ea3-92bce3455c2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.130.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68381768-1c35-4cc5-9040-ac46cfbb51a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.134.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4360c799-abb5-49ec-b03a-b5db257541e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.135.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a07e055b-143d-4dd1-aee1-a210e0ff944b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.137.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe271b4b-bcd1-43aa-9e50-1426020a1d94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.137.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6983f6b-263d-4cf8-addf-1ded55484bab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e22ea8fa-fb07-4b03-9033-db16c14cf0e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c619c11-1b59-4f8e-80f5-23af1fd82ede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.140.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59a89366-1ee1-45b7-9fd3-089eecb9b40f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50be187d-9fc1-45e5-9a3f-04cd18c670f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--654eb127-ec16-43f1-b2e7-ac69b37d23f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a8f4969-722c-4654-bad9-a1c35fadbc60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4091f221-481b-4512-8a8b-80ba0bdbe308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fab2fc7-17f9-4334-bd9f-bd5b27963c23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00334a95-1274-42ee-83f2-71489f00f282", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.54.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d67c511-c5f5-4fa9-a5b6-8feababb5fa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.56.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38fbebb7-680e-42c0-adb2-039be989472c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.56.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1258cfcc-469d-4577-85ad-d9f10f37286d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.61.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59079115-fb35-4890-8022-7525ab594f12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.89.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f94021bd-3b7d-4a7a-a6cb-24763565a785", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.96.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f1ac87-b20f-4a6c-864d-77900b96fd70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.119.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b3c1c2c-3a4d-4dac-982b-2f1f3110a21c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.119.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34411320-1837-4172-85f0-1a5f4d3d637d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.120.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09356314-47cc-4ab0-9d0f-24f1e2f5ec5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.124.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc46775-0eb8-4b59-8a16-155a7f83bc6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.124.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aac75103-1c69-47a9-87a9-98cab9e60d6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.136.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c12c5f1b-ef3c-4204-bd2f-220d67d4b101", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.140.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1639317-c1cf-4ee8-810b-69dd9639fb51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.140.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98437af3-9bef-4127-86fd-f42bbea7e11f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.157.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91ba1937-8878-4340-9ad4-ce082eb3fb12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.160.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec2e9d6-7341-4930-9b9b-b000757d40c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.161.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebdc29d8-a2c8-4a78-9668-9e964a5aefd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.162.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bdecdd1-7783-4124-8ac8-6cea88c8c656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.171.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c167e132-3bbf-47c0-998c-83e14afccb0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.172.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db1e6b4-b26d-49f6-a431-4bc0bb22dfeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.185.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98e85c73-a165-4d38-acf5-862448e9dea6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.36.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--625ead34-4394-4817-b9c0-287990501975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.38.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3151ca1b-bebb-4084-aebb-201d741ec710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.53.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c72db86-2cf7-448f-9a84-e3edc3e99c54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.54.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75ab9ec8-b1a7-4761-ba08-d2a607f0bc01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.54.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00ccc63-664a-4a77-878a-a87911d77355", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.58.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea35f79-d59b-4316-acfe-db571f175e54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.80.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22da2a56-9109-4abd-bf36-19273aded3d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.82.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--886ae8b8-62dd-41d1-ae14-73923082ff30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.84.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b04a661b-6e60-49f0-9a69-cd3dd95c2fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.94.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76803637-6cef-4ed5-9b5d-3aad5cec3b4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.95.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b22c2c0-96ca-4edc-8286-89445f107046", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.101.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f7a0930-3ac3-4b5f-9fc6-974497c1e2d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.113.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--743ed5ce-9ccb-47d3-9cab-2316dc1f34b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.122.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a4e984-0334-4742-bce6-7e7c4884a7c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.127.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c892d35a-baa2-47bc-ada8-5e7354dbb11d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.161.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1411f784-5a49-47d2-b4b7-05f7b3e806db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.162.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e516ac72-7bb3-4576-a098-8a741d850758", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.163.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dda1754-7639-4471-8671-6e11f243c05d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.179.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3ddcb5d-4dd0-40b9-91c6-e0d1f030347f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.184.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf2eb79-f284-4b5c-a2c0-5541075e6a3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.186.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6884e31d-6f98-4913-b51c-7d8ed9d5a905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.191.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--179ef1e6-f7e0-4732-ae37-5f40577b2c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.24.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b96df02-b4b3-4a0f-b39f-fc15af1981a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.242.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4f0014a-ec44-46c4-8a33-0485a3267544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.248.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a61e3f6f-7897-43d3-940b-72b5b546b118", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.250.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6880e8c7-9e25-4d78-b113-235aac3be52a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.251.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47bf4566-561f-4b80-a9da-c15060e1e5f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.251.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9841c34-2bfa-44ff-a114-58e0af76f071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.251.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faa67c94-b744-4f12-9053-365f393ea7e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.255.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9a05017-6e32-4b26-83d9-894284248d01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.255.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4fad7e1-41d8-4a7b-920f-8ea875da966c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.26.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e28b237b-655e-42fe-a4b9-135048675cdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.27.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f73235-1fa1-45cd-bd1b-631b8f42e453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.28.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84ce0ee2-009e-4430-a78d-b5757e2e41c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.30.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185de750-7c61-448d-a12c-771138654b78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.30.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ee5b64e-7ebb-4e92-b303-7e84407b397a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.48.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f9dcb5-6356-4c5a-ad2b-4dd3f0e7e1eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.59.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3370e8-6154-440b-9edc-c351d3e7cff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.59.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--845bb043-c991-45bd-a51a-24295744356c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.72.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d772e8a-9a71-4792-aa38-e126464fdc5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.74.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9cd4c3d-bd55-46ae-9a44-cb19cbd5d07c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.9.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--962a92c4-9278-43bd-965e-8900ea9313e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.92.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dabe5023-67a4-42cd-a508-1201b71f6934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.253.113.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76ebabb3-cb0d-4183-8bcc-a70988020cb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.134.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8399de-c8e1-48da-9c5b-20d378644f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.142.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7105a69f-a68d-45f6-abb7-28d4dcc1fff2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.15.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e7e125f-be5f-4009-b26c-4170495686f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.155.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f744721-5d81-4724-ba6e-c760a9fff08c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.159.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6229f598-4218-4619-9981-dde82909716e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.167.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf75011-e8dd-4948-a591-236f2061c67d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.169.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--545b47ed-79cb-402b-9a24-c34f57516692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.170.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e4bd9b6-b4ba-48e1-8c1a-7e8361ad453f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.172.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb4017e6-c133-4621-bc8a-3190e8303ffd", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.192.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc63b39-776f-4f19-abcd-6b0e44371601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.231.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ff782c0-dd52-4699-b4a1-7d724b258cbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.240.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef531d19-e526-4cec-a856-2be9f069d1c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.72.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0e62aac-22be-41de-b3d7-702362097bd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.74.32.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9cc7251-a7d2-4397-9fb5-66b050f7aaa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.76.69.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e08a6a-9596-434d-a4ca-02e3a4ef39ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.210.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb7e1a3a-7e48-4755-935d-d5443a99661c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.213.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18ff41af-58d1-4d6f-8e05-1804deaac049", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.215.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5552967f-02aa-40ee-9a35-73f1a8d7004b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.218.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa0c82e5-eb44-485e-990c-35966f5ce2e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.219.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4039722-ede8-4708-b3ed-0431c21f0e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.223.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26056ca4-e6f2-49ab-a8f3-d07fb1220e96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.225.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34efc34e-a35e-43d6-bf28-87cbeca610bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.231.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df321744-6806-499b-989f-a17ad6221727", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.233.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d079c6da-8b96-4a9e-92bb-34c57d4284e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.234.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0142a2ff-4bc6-4eab-9441-ab123648d9d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.234.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f1b8c28-cb20-438e-beab-9edb277fdf2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edec786e-e012-47b9-8d76-83225c37f1d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1467bc37-06ad-4015-96fe-d7809fb1f267", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.103.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a916451-eb49-4220-95d5-9092dbe07c1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.106.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15f9f591-4c8b-4cfc-9edf-c497662e7ba5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.108.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4782e5be-e649-448d-baac-a8840db64ee9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.110.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c8cdef-fa84-42b7-a084-1f814c8498f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217323b3-d940-4d02-9d3e-24ab1325acd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.112.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--452e2b3e-b489-4651-bf3c-9c4672b4509d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.130.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeacdc3e-b8a7-4c35-9509-da7bc47e720e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.132.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0198eb78-2cda-489a-9b8a-7669b0232336", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.132.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407ea09e-c279-42c1-98ec-285888871b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.133.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9b17c2-3d2b-4607-aad6-3b7340f2ea29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--791d3d04-2e65-47d5-ba6a-c4ef9caa27db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.139.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac3493d1-6f4f-444c-9f98-2fe83d88f95a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--418a4068-98b8-4341-ac6c-425d0a3f1d49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad458dd-6c92-43cd-b9cd-b3a54798c4db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--174f2651-ba57-4ef2-ae92-7159f29f9ebf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.181.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a663938-42a2-47f9-b989-993a7478ffd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.188.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--222927ac-58e9-4ddc-9cbe-358b55af635b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.192.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227d5810-f1b8-43e4-915e-ff77686aee08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.194.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eada764-aa18-45cd-8c31-27471f090f7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.198.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--769b9c0d-f3fe-4843-b8de-1948aaf065e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.203.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d30476-4e40-4132-884f-72324acf0eeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.203.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e32004c6-9495-4cb1-a5f8-3563b5eff164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.203.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef1a561-2d1a-44e2-97ab-61091a1c47b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a42232b1-fc1b-4122-8d56-c67b8ac1c85b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.205.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a8ef30-e7ac-4dce-a976-ac1e8c4eb982", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.205.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e12569e-2887-4795-800e-7025f23a7415", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.206.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--064e3211-350b-4b9e-bc94-69639656ecb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.206.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930f9c03-89bf-4149-b8ec-29c66804921e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.85.172.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1caa969-6e18-4200-aaf4-77807d112cc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.86.176.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--655264a7-d666-403c-89de-60ce166b80b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.15.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e066d5e6-e7de-47e2-8f65-063653ea2bf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.29.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe50b5f6-c08b-4e22-98d4-8c9828292b6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.30.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f3f4419-2ae5-4c81-b226-1d2f91fab215", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.35.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9e20aa-c2eb-4572-9fc7-4ce6d05e5471", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.54.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b3996d0-1aab-4f95-8397-f7865f8016b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.57.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe276b0b-85f1-4762-89d8-7310a588f2d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.58.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ca78d09-652f-4dd6-81e9-d6c39d93daa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.59.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bac70d75-dae0-47ee-88d8-881eb7427889", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.93.172.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bbb57d7-2351-4366-bce7-12726fab1cef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.214.144.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9370734d-febb-41c1-9819-4ab19e188173", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.243.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407cb9f2-cbb6-492b-bbfe-5308e5674a30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.216.244.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9140bcff-30dc-4daf-a2c6-2bd51c1f2e1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.217.233.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5e979b6-811e-4387-80c0-09faf8b572be", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.144.219.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9767ceaa-4c29-490f-a015-e04e24abe335", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.229.102.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bbc9669-e501-4dfb-9cf7-b7456931abc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.42.106.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c92c99a3-55b2-4182-b9bf-0f848737afb6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.191.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d166ff1-d180-4cae-848c-990780c14382", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.202.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--953397df-ea59-4476-8ea3-289251900e2b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.241.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cc226b7-8526-4312-a52f-3a0e00d5549f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.38.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7a621f3-7a69-49de-a30e-5539f6cda1b1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.48.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3883065e-f806-4572-b1bd-85cf7344f284", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.52.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--431824f8-77dd-458a-8d6a-104936511552", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.73.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c38fc15e-343e-45f8-8e82-9649a9f6795e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.68.238.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f4b0886-85ff-4d44-909e-d510c32eb8df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.101.64.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77af372-f242-42a6-ab2f-d878420427a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.133.168.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853ff70a-956d-4c71-b4fa-d5a6499c6dcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.133.192.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fed895eb-bb17-4952-9d1d-a6e0ad6312a3", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.135.12.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c3dc26f-0921-4bcc-9b06-54c020ef549b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.135.173.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb7e1808-9a03-4ff1-b4de-2a5bd61558df", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.181.124.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dee9bbec-45c0-433e-862f-48ce193f2ad1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.181.2.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faafdd0c-c26d-4d88-80c4-32b5a52932f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.183.101.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14b15f41-e5f5-41c6-bdbd-7c1c08d5d9b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52f87ba8-4bed-43d7-8f44-cda6d014b851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c01f409-ade5-4e5c-ae08-97c0d4836ac8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc6a9f7-75cb-42bc-a9a8-6169115e6b25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9aecccf-328d-45f8-9269-f891b0135798", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.130.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b8afb5c-e3e9-4749-b50f-2c4e81d7904a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.188.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bd8628c-e0e5-4040-8fd4-1e295447b761", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d2fb08d-a0cb-4655-ab67-7d1209fcb6b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce82424e-e7ae-4362-af9f-74e9290a50db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--367152b5-ad9a-4eb4-b7ca-b5b96d4c5098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a38d3c32-3c13-4335-ad67-b63384761e65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e7a73c-66ec-4b74-8def-f355b9e3d418", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd381faf-fc6a-4366-b5fc-7facacf2ed17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21454653-011d-4c9e-a2c4-65eac0f643bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.226.140.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33756fb8-1076-4ec9-ac41-40a30eedcb49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.29.23.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773f1c3f-22b4-4313-880a-ffb48fa674a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.36.202.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ed785a-7a21-4de0-9624-65b2dc477092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e77cf3a-9618-48e3-b043-fb2fc16a46a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fcc3ae9-067a-41af-91dc-28655da10750", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--918847e9-7d9c-4fe4-9781-d3a34aa110d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.83.143.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba102a8-f9ca-4080-ad66-142bdb0386b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.89.75.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a98ed1ef-18f6-4c46-bfea-a7e62b4b9cda", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.99.196.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f5622e4-496e-473c-aaae-a8afc94ae1dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.20.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6469a33e-508c-4024-9ac3-643055039596", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.23.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1073f97-eab2-47fd-99e7-abff31c7d604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.25.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1139d31e-64d8-473e-835f-0d9db44cbfd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.33.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8d6a0d-2995-40b9-a8c4-ea16d8d2c2f5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.72.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3563c9a1-26f0-4d4d-ab83-72d0a0d5bf41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.16.169.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51a2d2a6-b3e4-4fc4-ae0d-27148046abf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.127.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ed43c5-72b3-45ef-8de0-42464269b3be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.7.233.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b36bb8f-0b4b-4a03-b77a-d3e8ec076b71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc06943-8ab9-4588-97c6-824cb5ab2660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d321338d-9923-43d4-997e-f27ac38ddc46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.110.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6827b50-e254-42c4-8665-4873b8256d3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.111.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e2bc642-a16f-4ec6-870d-dd7d5d6c374e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.202.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb3a2efd-8cf0-476b-a2c3-a3a3509cabac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.195.215.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--438d27da-5c1e-4669-a5c8-bac018111d36", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.195.215.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5209bd7d-63ba-4623-b718-d7f71ba5f1f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.195.244.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85971785-d9d7-465c-be7c-18c1d1ab4d7d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.36.232.255']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--974d18f5-54d9-4c7b-9d02-7d56c45b2ae4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.165.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bebf19e2-7588-4cbf-86c4-89a47292af33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.57.81.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b812d059-f0ec-4504-9d24-3c552292ecbe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.111.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0988967-3b9e-4584-814b-90bff2c6b0e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.75.149.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc78c0c9-9e63-467f-9c35-666bc2d52c85", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.77.158.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720c53a5-450f-4e7c-8f24-98d6bb1de57c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.77.222.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c4064ba-51c5-4576-b61b-95b252dcf613", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.85.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--587eb371-a7a2-4bd1-b3a7-1401c3c70e4f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.83.102.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ab23b1-cc60-43c0-ad37-d219fe5d1c68", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.140.76.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75335dda-ce07-4397-8916-26a2e4585043", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.146.90.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3c9cd5e-aba6-4b66-8925-3c8e7237dcd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.82.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e97c2bb5-b23d-40a9-9284-9e21e2c5e6a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.88.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f463eded-c64c-4c45-b664-2500053d2587", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.89.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79abb1a5-009e-486c-b7e6-970ffa12f7a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.90.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44bf5b61-d2d7-4f85-935a-0a222ea346ce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9671cd9-3bad-471f-80b9-88b4813fbe8e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2411e593-3574-4355-a874-d31cc1bbcb53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a45ebf5-f24f-43f5-8109-3e88fca9560b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26162a68-71d3-45f7-929e-af0bc01a1612", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.144.125']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef63858-f372-4b5e-95a1-8a9ef33ee6e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.145.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356b6914-bf00-415a-9b97-bce0f3b7c5a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.146.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9e09c35-6f5d-4bc3-9cc3-5492730a5ef1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.169.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1435eb17-f329-4f47-a2c0-4db4356dc159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.182.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a172dc9-a4f0-4250-9b1e-cc5f2c2b3812", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.231.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c79e29e-92b0-4d7f-ab91-c9b5491d7e6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.20.198.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3648383-0599-4bf5-97ff-a593bff72a25", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.224.109.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbec3ea7-8728-437a-9286-30b63cbd3565", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.236.56.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78bee9ce-8498-4bde-911f-7a594af21626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.249.221.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff85f1d9-1d4f-4405-b92a-188da7bb76f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.87.177.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--459ca7b9-e149-49b8-87a5-dea179fa6684", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.87.242.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529bd348-1871-4a0c-822c-0b071f4588cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.90.4.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0abe33cc-8fda-4377-8bff-90363d8edcf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.144.112.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b82ab78f-a461-4ce6-86d3-1c00d433b4da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.144.115.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54fd1f02-2c7f-4088-b1ee-f2ac2d800a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.144.98.172']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f810949a-907f-4096-a3d8-4d5fa6ff2d71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.152.198.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cc1e1ec-dc26-41bc-ab51-af3def42bb92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.162.175.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56dc02cb-568d-458c-96ac-444696aa0f16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.164.79.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--175777c7-7052-4174-ae31-5bf578cba592", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.189.34.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3efec0cb-75aa-4a99-a883-d34af3d851bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.208.51.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f1506a-1a1e-4e3c-8390-09b6563c17d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.211.226.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98f08acb-30b7-4ca1-bbcd-775f67b73842", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.227.40.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e844c7c2-838b-428f-b8a6-71c3a5cc803c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.227.93.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04967508-2d20-4d6f-9ed6-f23ee0546141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.242.125.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd8fb835-b178-45be-9537-d7b9bc10753a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.242.154.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f763a47-6aa7-42e3-a3c0-633b8d39e86b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.38.157.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebd7f6b-25c1-4778-90f0-c69533166eec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.80.215.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--913e6aa6-2bef-461c-9022-3cd124c9e863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.80.240.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19cd0b51-a880-4195-accc-cded3cf12526", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.128.218.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9587b246-492e-4046-959d-5689c37a65e3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.128.225.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e74cca-ea6d-41ea-8ac8-30c16e1c53ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.105.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ca5b388-7a9b-4532-bf07-ace328bb0494", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.97.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63aa37f9-5bec-4656-8141-a10e841b448d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.126.15.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3734f7e-bee8-4286-9512-6035431d623e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.15.58.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7edaeef0-230c-43a3-b700-c3bd21ba8d1a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.26.132.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23340f18-7190-436c-a839-9c60afc9d48e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.172.52.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d4e5298-f556-429c-9adc-f1550d182cdf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.188.42.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--046448cf-459c-4c3f-8b79-377bef6a1560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.188.58.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1054c7a4-cac0-4ba2-a554-557b505828ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.191.125.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0656a73a-8a13-4d40-b228-8cc6acf5181c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.178.209.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59051ec5-08d1-4c7f-9797-00d50a6dacee", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.189.238.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93ce703c-91ee-4394-ae83-65b36bf43582", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.222.211.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d2916a-8318-489b-8544-65218b049b26", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.72.55.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a61f331d-906a-4d71-bf4f-f65deb39c986", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.85.201.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c5e70f-5bc7-4700-975b-4e4ada3dfd05", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.106.104.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4406905-0ceb-49fe-ab06-375bcd6096f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.151.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90511ed8-91b4-46af-9fa8-e287449ff7d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2019-5418, CVE-2021-41773, CVE-2021-42013. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.168.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773", "external_id": "CVE-2021-41773"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42013", "external_id": "CVE-2021-42013"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0922a381-722d-4c84-9074-6282df11975b", "relationship_type": "indicates", "source_ref": "indicator--90511ed8-91b4-46af-9fa8-e287449ff7d6", "target_ref": "vulnerability--14d0df41-42dc-41e6-9ad3-08e6e237cf9a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a712418d-047d-4ab8-abf2-e6068ceb9e43", "relationship_type": "indicates", "source_ref": "indicator--90511ed8-91b4-46af-9fa8-e287449ff7d6", "target_ref": "vulnerability--611c1a3c-aa7b-4f86-84c3-43bc23370cfc", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6fe4bc43-a1ab-45a2-85a6-35571ba29543", "relationship_type": "indicates", "source_ref": "indicator--90511ed8-91b4-46af-9fa8-e287449ff7d6", "target_ref": "vulnerability--e38995d3-0612-4c44-8994-31701747295e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292745c4-b117-4ae4-b4aa-1fce65cc92de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.171.184.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3838ee5-65d4-483b-b1ca-0edd628d1b53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.182.85.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfb3b724-5641-4cfa-93f9-790665b29e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.189.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abc3e690-1fa1-457a-b207-29be27c31e82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.36.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04036c1e-cc41-43e3-9b2f-06b35c40c7d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.78.59.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18a72ba9-4b31-4c71-b06f-279f0c5c31d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.150.187.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d789935-b365-41bf-a542-ac635f872af6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.188.83.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ab01201-ec1e-4aee-adfd-e0cb4339a70a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.101.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a2bb096-745d-4877-ac20-75679a750c0f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.107.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82ba1f73-9861-48dc-8eb7-9fb3e4a81d57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.109.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43487b05-d5f5-4a2a-9041-3dddb8e72bc1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.12.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c866480b-6427-4fec-898b-06bcd15accd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.146.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca619b15-fe0a-4cf6-bfab-4170cfb7c9ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.155.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a60dbefa-ba45-475b-b3ac-53994943cdf6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.176.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c50b9d5d-6aa2-4153-8346-5a9a5891f5c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.33.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71b103fd-c116-4cf8-9458-0098951fd093", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.59.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c8b955-a9ad-452d-a51e-edbe7915e2de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.155.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08d40694-0036-4383-bf5f-838a8ddbc359", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.201.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fdd64ff-70ff-462d-b2ed-a453706c225f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.236.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6137d0e4-66f3-4fa6-8ffd-def2dcc40ec7", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.41.88.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82ca1f34-f606-4f35-8100-4137c43a5cad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7038e10b-93a9-4899-aba3-e7f80c983d39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b606925-b2bc-4b7c-b986-89c721b0e4d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e010cea6-e866-46fb-9540-130219b59063", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c010126f-ce02-48a6-a2ba-54b08652b094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a2c413-8ccf-4d18-8d0c-3a59bb217d3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a93da912-eaba-4b24-abf2-cb629f53d00d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7554480c-a283-45b2-ac34-9d7cfcefd54f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d39a42-aa73-4a87-b4a4-8a36a2600a56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f55b98e6-4cb3-4afa-abd3-d67e8eb6bfb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92a2b3d9-5e6f-4db0-a13e-7c084b62bf66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4817f7-8cb2-46c3-b3bf-8ef48f0f579b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b00cb7-8388-4c8c-bc43-960eaccca11f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09068c39-f3d4-4621-ba85-7d7a8ac9168d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63208308-2638-4723-900a-4b21bb7d43cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b47e12-d5a7-4342-ae1b-2bd4fa3989dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--993ceae4-d1e5-4847-a2d2-a9dc225f58cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a998a0a8-66f6-499b-89ae-82c23bba5a43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6c4cdbc-ed35-4acb-9826-e2e4a75b0272", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca38dc0f-c933-4c6a-9564-c9eac59ffad1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f2e2af-f05c-4d9a-8737-57c8b89f5676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4e96071-ad9a-4554-be1e-8766ab26e85a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--226dc58a-afca-44e8-827d-f61ace165e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f045509d-9ff5-41d0-8279-c42d1902bf28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ba09b7c-f6fd-4261-93c6-ba5038356da6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea07bc80-cce9-4d38-9d1a-1621a937e4a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71758599-6cac-4aee-92bc-bcadf36bdf05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--addbd00f-694c-4b47-afe7-413ece0e8bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cfec46c-b6ae-4fc5-a65f-28710f452a77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--749a1fd0-3280-4639-8c09-43e1caed1df7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8950d6dc-f413-4706-8700-c40086a310f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f91d7db5-ff72-410a-b2b3-1193fedb7d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884c1fff-7f33-40b8-b82f-e2445ecd1081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bb55635-6454-4428-9ec9-e6c6e9f6a557", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a6673bd-cadc-4892-a242-7fd84316d5d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12be65a8-cc56-4966-972d-54fb31453044", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1acbe701-faff-4a7d-9370-79d2c5f9ddd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c5471c9-a153-46c8-9b9b-d074f7b079d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fccee0b3-4176-4f79-98f2-2e1d43427d99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--597eee2f-e2af-4de9-b661-530ce078df80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81c9f92-73ac-4d76-8edf-964e1882dda6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62f2df3e-f253-458e-9756-43c3b569dca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e77d99c4-a1d4-4576-a702-82ce647cf1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c50cf1cd-74c6-4283-8a0a-d1ee4dd0fd33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8a9cd4b-af63-492c-b1d9-b549f45a478e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732c7059-37a7-44a1-9325-736fabe89749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ede21063-3c29-46c0-9d16-ef1b067cb306", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce0c1ff-d5bf-4b69-8911-3da91648959c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3086a2c8-830f-4fe0-b3cf-96651009e7c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--160cde2b-ed91-4f89-bdb8-7963900686e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87397f3e-1c1e-434a-b5e2-fd75e228b985", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2066351-2976-491d-902c-6997b16170b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--392c9422-abdf-4095-b9c7-29d10bc9ecc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--430a15e3-dc39-4a15-9b28-f65d028ad41c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da85161-d919-44de-9da9-855283cf51f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43be0b10-4f1d-446f-9446-c24f54113332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39fec5e5-758f-4096-a1b2-a6d7811ec9df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fa11a95-e7f0-4c64-b243-7abfd215a0f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d67595-813a-4fe9-97dc-0f29570d5a5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d81832b1-dbf5-48b8-81ca-6d64d4dc01d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4512cacc-7cf3-4e7b-965f-3854b9fb56fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.86']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--538cf9cd-1a19-4241-a65b-617d81ae0d40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6640fa72-fdc3-43f3-8cc7-c4331c0ece6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a69c7b5d-42fe-4458-876c-c99184add94e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--883c17fe-ebd3-41c5-8f76-aa8521529731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.104']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64fb4034-902f-4ec3-ae2e-f8f3c53c3d64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce2a940-3e0e-4c3c-8933-4569f5a163db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.109']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04859c6d-0e13-4c48-9d66-ebdcfda2a6ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64fdf1b3-b139-42c5-860e-fb015c6524bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14015bf1-48e6-456b-b24c-e21473618706", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853ddbbf-a168-4c5d-8110-e1ef37178cac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9642754d-0f7b-49b6-8dd0-e6c4246afc40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74130c0b-efa7-41a4-ab2b-0fbd5dcb7903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0ce4c7c-af0d-4406-87a5-2f3ff52d8a94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07725529-b1ed-47fc-bc00-4b41e1e4f1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb9c1b1-ffa7-4d2f-be5d-ec999b146c56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a603cff6-0233-4f26-afaf-51af4cc5dc4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--239aa44e-0ff7-4428-8049-0c437144ddcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49368002-bd69-4763-8c4f-b81f4bfa2671", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--996f25df-d027-4468-bc35-817c8e7efa5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7381aaf-234e-4340-b1c5-d522dc6a9dd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a16f6b65-da80-4369-bf9b-5c5826663115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d14293fd-842d-4b9d-a155-ab3d1558676c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247df40f-6475-4b45-a934-2d2289cdb580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63b8eb2d-bae4-4c3e-ace9-85de795a272d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e26813f-a659-45d5-9913-5f0de66a56f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b225098a-57df-4e91-96fa-413b7e736137", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41abc79b-a010-466c-a092-9cd4803d5496", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed6cb406-1ade-428e-b67d-ee31b875ec93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b3aad64-724b-46b6-b321-bd4493e672d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c62bd858-d559-4ad3-a71f-ba70e709b9eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f279f191-0436-477d-8dc4-c6458942fc09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f1f2fa-b53d-433e-b7e8-c6210a62cb5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9877ecb-b76f-4960-aea2-9ec17136367a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87186dc9-69f5-42d7-83f8-299a8b6bdbf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.35']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f4c642-a7f5-4c23-96a7-f6da5e7ff7e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7786ed93-6773-4a14-a2b8-c2d5ff0f038a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--782b3049-4bb9-4a53-923d-6b55fc1675c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2129390b-8879-41bc-9753-334f6ee150cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73fca511-931e-4770-8818-17fbcf14c466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a34749bf-456e-4ccb-98a9-be591a1f3f4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f92773f-d75c-49f5-b775-de084beb6033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27c15cba-1b69-47d1-aabc-ba60a869b84c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--359bf9c6-8635-47de-9e4d-85cd7e778419", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ece72ad-12fd-40d7-9dfa-53f7be5b4b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf8af3f9-e614-466e-9854-36c26d8684c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56d637aa-cdac-4b97-996c-1727716f87ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46dfda51-34ab-49b3-806a-ac26eb410bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1951579-63ab-41ab-95ac-88f25f8f42be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7f813f8-64fb-4287-ad5a-c5dc4166eb49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb69154c-2bba-4b92-9d9f-8a74672dc365", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca473c1f-a3b2-485f-b113-b47830cc9aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c930a163-a3e1-4521-be48-a59b0d33eacc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.97']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68584ab4-770d-472e-b55f-59dd4abc732b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.81.30.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a6e44ff-7d59-4986-8731-37dd3655ff6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.160.111']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea7efe28-2290-479f-8465-ac723afe48d6", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ea519a6-f270-4a74-819b-85e113d24a0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d384ad35-e787-4271-a54c-feb20ff72b39", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb3cf6f-70cb-48c7-96b1-eff7fdb37d90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7e1257-8429-40f0-8611-83f4e46d7cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b0316f-0285-4cb1-b1f1-6975076ad1bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac28c61-36f5-4026-b395-1fd74f1c915d", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84da3f9e-17ab-41d3-b6f1-d5d1a56e1fa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b448f76a-d2b7-4ab1-94f7-885627ed49cf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.20.217.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7221bf0d-04fb-4b10-ba7a-dfae3df53d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a4db2c9-1d0b-43b7-b184-accd3b1f2ee6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65e2a70e-9d46-49f5-9823-01edd504767d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.107']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d92c9c3a-d73a-4473-81cb-a980bf0bf6df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa44bc7-04bc-4ccd-94cb-a78e607912b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1df18879-5657-43cf-bab5-6efcd3ee5e42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79c26ca8-17ec-4139-ba70-af009a16e532", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c1ab13f-4952-4f0c-b54b-0d02b4d6a0bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e92d01c7-52db-4cb0-8d2b-a08db399364a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d8cf6ba-8ffb-4bc4-b399-7dc4abadbf4c", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbd8a220-beab-40dc-8975-c6531eab8289", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62d6cfc1-0ed1-481a-a900-1cd986ee3c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298a3575-595c-4edb-b2ff-e7f5e81bace7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcca383f-cb0d-41cc-9568-cf276a1146a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcb51111-3b16-47ee-8e7c-d9bdaeb39ab2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149d3261-1ab1-4787-b22b-a4655905576f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--204be8cc-03c9-4aea-898f-022076eaad1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92c1d09a-bb83-4ba9-9f10-1ae7a4b2b39d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e223fade-5437-44dd-8062-27dfb91a5c57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17ec2fd1-d537-4e07-bb6e-547a8b26fc78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a485ac1-f1cd-417e-a4b2-e40f32bac010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b36f8d-0207-4d36-a4be-bc25bdb7506a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4756f5d4-7a18-4ac1-b5e6-0ef4861092ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd56330-c6f2-48bc-a8be-af062f01ffd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94ab4250-79d0-4658-9daa-0fc4eb0a2b06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd6f1b3d-af7f-4d6a-893d-075e0c8d4882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--198c9c90-d87a-4b29-a59b-67ad7272323c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.163']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aee7f442-d974-43b8-9ad5-f1f4573f64b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15ca5c6d-e631-46c6-80a7-1d793527bbb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d469102d-aaac-456d-bb44-c5c09f14b06d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2621ce7-cf3e-4db2-a9bf-61ed69249a57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc764b89-9573-4252-958e-b57925e10985", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c70647d1-8fb9-43b5-a0b3-df55dfb1f575", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da8b7673-132b-4b8a-a704-a30d48785a14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acdde07c-0293-439d-a7ed-e6ee301e9f17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a398683-37bd-41c1-ac0a-7781e57dd80a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.188']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb06e747-0895-445f-9b66-d048cc06028f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e9a4ca6-102e-4d8f-a2d4-ccdef03e806b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b809bf28-4a30-4d2b-95be-1d8829597e87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fe34e44-ef0c-4f75-bafc-31a9229db031", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b131e142-1cd3-4441-8364-239b01c2182e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10e4a388-8454-4ab5-94df-c1cc24339160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c2f09df-de8b-4480-8dc3-aa6f28219b93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e32d51d7-082d-4476-9f53-1af2748e1f20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--103617ba-b29a-4078-a159-23083d833cbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19b9fc1d-a0b8-4653-bf5c-b516062cfe74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d47dcc7-9177-491d-9f8d-8e0018362a04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ee04af6-70de-4478-9bc1-c83ad7d1f65b", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f940a8e8-a4a3-4356-8115-3d7a7250f0fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--444c6ef6-ada7-4bbd-811c-0dea3923769f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2fa0cd0-e1e8-4277-80ce-d5ae6416f73e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8853f50e-8ca3-4a39-aab3-2248a5f76ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39a2334f-24d8-4bed-be8f-3d64045c109d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b5e230f-8e46-4704-adb3-17a1d31ec6b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674fd10c-ff21-496d-8634-39e8df1494c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1596a80-ab1e-4ab4-974e-3790dbb10e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7dc61e1-8172-422d-9dc8-bc3da2103c6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b2ba3d-096a-4ee6-a39a-09b3001c9022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1c6f2b4-3858-4080-a110-73a119199ee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b993189-276a-4576-8d9e-b0b54574dd9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a6cb8d-d686-4c7d-9080-0beaa77ac9eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0736127c-b03e-4168-9934-30ddc36a7c2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eed5a22-f522-4113-8d26-c1a6b51fa2f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d1fa683-27fd-4c65-8c6b-bc6b070b6484", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d9f7fb9-57ce-40c6-bf58-afb33305a86b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13aef32b-8e2d-453d-8c46-1d4a9cf4041f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d0c6206-ff85-4095-b633-99467fd6e584", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2beeead-a187-4a86-a212-1ae7c5653698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aadbbd50-d12f-4daa-9028-d2a1d1698da1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99fd6363-3bd4-49c0-83c9-18592ef82e37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5326ac5a-4434-4e4b-93d1-0c09615d98d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.62']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf2dd2d0-1826-43f8-83aa-94590617d1ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096ed643-4919-45e8-961a-85fb1a9dc5b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803f4386-9e47-48bc-a966-d53640e2c847", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeead983-28a4-473a-bb58-2f1a445e8b70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e8ffb3-197c-4133-a05a-dc6995f47c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5022fe82-b9a2-49e0-8983-9d9db072d54d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ecb9faa-fa51-42b9-9388-49831fc17208", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c24544f-8d5f-444d-a7db-c384614c02ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c902c0ac-7823-4a63-9fb7-75222eb8b749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18f902e0-d792-4038-af5c-336d586b281f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19a3eba7-8ed0-4e9a-adab-1e77cb1668c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d65080f8-fcfd-4309-b9c7-78ec9ab1e60e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--705b658f-a89f-4b9e-82c3-fdec716deac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95551685-8fd2-4a65-b49b-37063a1b1226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.123']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1fdd565-208a-44cb-8c4d-f1631c9714e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b2a084-f496-4a50-b5ae-f8f4038a7724", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c02dcbf8-789f-4eb4-a7b2-0e95829a312d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3500be8b-0d38-4c51-a4be-a03fdecb5872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--380282b0-99d9-48ee-8d5b-c7652f3cd227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f429b012-bacb-487c-a9f6-2e92dd09c858", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd67ce49-2679-42ac-8c4f-25299fd18983", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--102e6b3f-2f86-4723-bfa9-09fb52442986", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc46ee85-2e46-4d49-af79-5e34e5f31d0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1ec07f8-b0b7-431b-af1b-5d06d80f9383", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db171d64-3a1b-413a-8d10-02c9504bcac9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6577c7a0-a7a5-4646-b630-f44be6a94ac9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.85']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e90fcbd4-e07b-4830-ae20-51b5c7776580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f710e01-3193-46d4-9b02-32174cc270ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beea47a9-4940-449e-a4e2-24b417037804", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b7cc6e6-bfa1-4c4d-bfc3-6a0884a0c6d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.101']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2030e076-7d6a-45f2-9571-1af2b85af244", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.113']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fd1063f-3676-40e2-9671-cfbe58135e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5d96a3f-d201-4d2e-8452-fa211b60be72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6db9f20c-4d7f-47fb-aae7-133501defef0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.116']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09718f95-512e-4f11-b28e-33a7d60a90d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17e1ead-d23f-48a1-a486-ac3cb8f613e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.120']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9571f6a3-4769-4d7d-b325-00c000ac53dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afb025fd-e8ef-4998-b18b-5f58e1163698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7893b5e5-82ed-4c36-a86b-2bb6d4a90531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaab6dd3-4b11-44d9-b738-48e459bbee70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6891d5-842c-4f2f-8840-92803349f59e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e915161-4b98-4c18-9c3e-58128d2ae7da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473a2205-9cbd-49b8-b2f7-f8442111b7ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c590188-cdc7-4d5c-8722-708667844dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8991e880-5d4e-45f9-ac6b-37220ece0e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e99ead2a-8a14-48cb-8e3c-bba38a86039a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39dda6bd-a233-4058-9abb-b0b479367558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f757dc22-1ba8-4769-b896-20ff4b545046", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdbf48e6-4e43-4272-b009-67a9fc9039f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bcbd7d-6250-4997-bc4f-e325f858e59d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcd1a7d7-22fe-4b7d-82c3-f6a85b8bcf49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d8c0271-5f1e-4399-a1f0-e5b1340b087e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.151']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43d96630-016e-4ee3-bec9-3a0179d86f2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--131c054f-d4fd-4c8d-b773-f1955c3cc7ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.153']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69879ba1-9c46-4611-92ee-1d05a2f8b196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16715a11-6698-4e7f-b938-7471720c6c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835394b8-9c16-4fc2-bdf7-2e605a550138", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--465fc953-d42f-44ec-98f3-cf03d4d1095b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--626d0720-bddf-481d-bb58-a412ee0bda0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7e0cf6-0a61-4af9-987c-73f3204ebb58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e77a49a-a543-4906-9b59-ae4212f90a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6d45850-450e-4f33-8a88-ca16bd50a608", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c81a364-aeb4-4d8e-b4dd-80cbc2075c1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ace82091-c0ed-470b-9a33-aa8991d5f33f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e2843c4-76a8-465c-8cf7-eb9accc5e712", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55c0369c-f37b-495c-aa0a-30f3259debfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecc5b062-6b55-427d-9668-a3d7689f2fdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a031a4-8d8c-40c5-84f4-97624d02c47d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca7af8a-0119-4f77-8799-db2d1ae2a7f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d6ba5e3-9904-476e-9126-abd5f4b9739d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5af15b1-075a-4235-84fb-cf8719030f07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9c0df7-8f92-4a90-91b1-a3def9d06bd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--306965bc-d67a-488c-b24c-65df55b68c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a19326-8139-417e-a35e-06dfe91a4356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a11124df-9178-4f48-91c5-d5b809181e83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3424447d-0b58-42ce-a3d8-88b6f3b77290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e240009f-30fa-4b77-9b2f-ef1a0e81a4f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d456880-2014-4731-a8a7-8142a8271b7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b1ccf8b-87ea-4e74-8527-bb728e3be0e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f9b2a7f-d0f9-4718-a72e-beaae75c7c11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--915847a2-8e20-4796-a42e-3aa08ebd8d04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70f85517-2383-4ace-9589-a1622e514816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b381b5-7e69-43fd-be92-773d850046d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6adbea04-6a99-457a-acd1-bfeee1235b4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9922c363-a755-469f-8f20-8a682fe8dc3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1048f1c-9556-4ac6-92c5-1b298ef208ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc2df9bc-f2f7-4d86-bf19-bfdf52bc3b60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f6b8889-140d-4ea7-92a4-0b505ba6df2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--012696f1-e030-4277-a64d-326f9cc5e6c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d507f1e0-9c60-4c9c-8afb-6aa58d5e38c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b64440f8-a9e0-4e97-85b0-47541a232038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d6c9aff-fc87-491a-83a6-7a9da06c6f15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d482fe5b-7b43-4c39-a51d-45b005427124", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda4e13b-b7e3-4f44-8233-ee0cf78dd504", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cad0b5e4-cc83-443a-b682-9d8c0334a1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4832d185-c9fc-407b-bf91-1042c93b60ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd110df-435a-4800-aaac-53faf275b652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f76a5b1d-5ba7-4ec4-a7cb-774fa48ed84e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca310baa-ea65-476a-a1d6-b236a2eec8de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae393df-d61d-431e-bddf-649f0d35ced8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4bc069c-9d8b-47c8-b9d5-ce5485cfe3db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e5f1ee1-07ab-4cd6-9c85-e2601e50d895", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73ba12a6-2c50-49ec-bbad-82d0bd33430a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee6b7c1a-4160-4e8c-bd4d-8454834976f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77504325-c6b0-4ac1-845e-a907532e1d48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a120ca-0253-4201-9ae2-a6d00be0ac23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe41dea5-f80d-4507-b5f6-bdba41a64e37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c074061-8d6e-4317-b44b-6c4add56a58f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b055b2d5-24c8-4dbe-adf4-495aa33255ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed681c6-f25b-455c-8bf6-b223c46d527d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbc80846-eaba-4d87-8598-0828798e4d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4878d72b-16c5-41b6-8370-bf18ca093eee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12e5c7ef-c909-44fe-b110-a3a28ccedd99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9307d9f4-eed3-4860-b3e2-fc2230135f33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75bcd732-3d58-4848-a2d8-d666968717ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba459b3d-9501-4119-bbb7-2833ddce404b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37de932-38e9-42a3-b51c-150118c18e69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.219']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d87376c-608d-4aae-82d0-0be9808bf9db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6441c559-79ad-4352-8410-834a4e1e4b14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6c752c3-96e4-4fda-8854-63fa680994f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.222']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--638ea721-ef43-4cd8-9b81-71a820b1ba7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e3c09ee-e289-4525-ad63-55ba1c6f97e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d2fb60-5a88-466f-9488-3819c27a23a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bae332e8-5563-4928-9e64-4675cff97c7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc8f67cb-e5b8-46f5-b329-d80a55067f52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40ec46ba-6658-4baf-a287-0bac3daaad8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfbc1e13-7603-41f6-9111-39c30afbc1cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12560346-c4ff-472a-bca9-024d879d768b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1a2a219-f58e-43d0-a67b-d6bc757fbad6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d885add7-bfd8-4c50-86f5-6580435503a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4df18a2-3f4d-4920-98cf-296be1044c78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77d3789e-0220-4fbe-918a-5e1341830777", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e56e2d-7974-41a9-939b-42a86ae51462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c49f96b5-531c-4902-8fc9-48bfbbdb3b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13766c2e-30d9-4fff-8bd4-9a79bb88da19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--310c2ce1-dc7c-4b53-9aa6-657122bd7faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cae55f4-eeba-4175-91c1-dbb8ff4c0d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf17522-e950-43f5-97a6-398b32082f63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b9ad99f-b5e6-413a-b8d5-fad7e5a20f96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fba4926-fbce-451e-9366-f42aa6fbcff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d08f23cd-750d-429c-8a7f-1c78733a0ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca33757-cbb3-49d0-992f-53cbedab4b6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceaacd9e-f359-40db-b11e-5cbf20476668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1000f488-8e79-48aa-997a-126fc3a28640", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8506c49-6964-41b8-8efa-9b399de61242", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.252']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c4783d-6f4c-4514-91b0-ef3257ebea08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--528bdf5b-c3ad-45c1-8a3c-1216aa94b98f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--babfcce4-a37e-40c7-923c-c0e1d8f41b50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6cd8b1a-569c-4b7c-a14b-c134f4c24dba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d759de9a-0e25-4449-aebf-89fc75c00e11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d29d60bc-6a33-427d-a864-75e7cf57bed3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4fd84b-ed48-4e4a-ab2e-778101522d1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda5ec46-e6f6-45ba-940e-83d11342173b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f6d0bdc-1d28-4720-bfc0-0fc0c786cb24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--393cc871-9b23-4d26-baab-b906c3e6e334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f3e9d2-f4d7-48df-bdaa-70459c8b0fce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4b85a38-ae9f-4ab1-b273-1e2d629709b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f7f1f0-e900-46c4-9a70-4823a08e8017", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--365b9996-58c2-4d92-bdab-e6a5da8f9d48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6123f0-908b-4512-ab57-a6245e4d9e06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e9dbc82-d303-4b2c-8619-051d42714166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--528da01e-16ad-460b-a652-033981c33fc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--314b81cc-c9a5-490d-be34-06512a0077cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa21569c-1238-41f0-af74-b4661db350bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2cdbce9-00fa-46a2-98c7-f5d64d2a0af4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8e5b290-9024-4ede-b62c-04ded42de70c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--502e6d20-9668-45a8-a178-f03d00b17498", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d972f4d1-1387-4f82-8460-33dcac2312ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--971e2d56-be8f-43bd-a37f-0a842211b7ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acbb10aa-4aa7-4173-b13b-1ef655ed4c67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa341dc9-348e-4a35-81c8-6edf235fd4fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7985bf99-4534-454d-820b-2ce14dbde064", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb38ee7e-7821-4757-a5cc-d727c48d4296", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2550b73-06d2-47e6-ba7f-a77f8fd60444", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70b9d8c1-a426-4e9c-bac9-3c133534a2fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.82']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e216bff5-be1b-4dcb-b734-09238839c0fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.87']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad1ecdd-1c5b-4717-9b01-b9e32ac1982d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d14b73dc-aa4d-4fc5-a054-9a4494481082", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f27ef40d-f821-477e-be35-cc7b70882005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0cf699e-e0dd-4668-9cfc-a50988ddbce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44d6656d-4f7f-4ca7-bc5b-e793e7b47e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05fc7a3b-163b-4625-971e-cc4f29d5867b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21c18383-c7a9-44c1-8edf-1e770d192e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d07f4ab8-db3e-4e5a-a58d-61a78b0735d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28bb430f-d5bd-4103-add0-ce90b5ad7f55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bd7d66d-d951-49ea-9632-5ff52d4674d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bd5ba31-3bb7-4aa4-90e4-c05d5f05e9f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f677459-4957-4343-b461-319ecfd33676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--911a9033-09df-40b6-a5c1-586657600319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f06b21-b8b4-44d4-8a9f-bc18b7125adb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--832ddd60-2334-4697-af8d-bea3beae5243", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--112701be-5b1d-45c0-bce1-c9b640f1df4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--723d5ceb-dda8-4f68-82d6-0cd9a2eafe94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b771eb5-a89b-46f7-9534-dd58b97725b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9900af4-7f96-4ee7-b87e-dfd3ea23f6e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe1d3b91-99df-49c5-ab69-8d07489a111a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a11c1ed0-c337-425f-aa78-6d7ca30c4af2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f48be31c-25d0-4a2d-a31f-5ba1f1e7ee18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20b96e19-f915-40d6-bf65-6253139542a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c052b6-199e-4c2c-9893-71d59596fcf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.212.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f719e5d6-e336-411c-ac47-e9bc300e54aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.220.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0eca258-c4ee-46c2-abc4-0ee0902f363e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.38.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54cd787f-7b6c-42c0-8c01-35eb42ea6e10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.40.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89df2e09-d43d-4078-bf75-28d0525a4b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9a2a64-d29b-4c3e-a2e1-22df06e2629c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29d4d7c-d311-49ee-a55b-30e3a426a641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f43f3c-0c91-4ba4-94f1-4a034b918231", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.62.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b52273fc-cdaf-47dd-8b02-6a6fe9a5bf64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.234.157.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8ce969-90ae-44e6-8608-04654f92eb45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe0bae7d-9796-4295-9217-e7efe6c07c87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.205.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c528958a-2487-4af4-97da-65a4b8f7aaf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8509264-5be5-491d-8a53-5125cfe8cbcb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9baba5c3-422d-4a01-a48d-718727f9d61a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.75.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dedd953b-7b63-4a31-9f3a-17ecfc261b71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.90.98.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd75eeee-9b87-4231-84c0-de7c0a578891", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.158.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f3396bc-77ad-42d4-8780-2b2c3d534021", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.170.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--455db7a8-e740-4dd4-baaa-845a7ec61b3d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.188.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f01b8d82-897a-49f3-8679-8c9d83e92ea3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.52.95.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23735906-db77-4054-9fd4-ea15adffa218", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.103.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c58ee24-4019-4710-889b-efc729eb5733", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.138.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa11c71-add8-4c0d-9931-5b46db816ff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.165.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--661cc194-49a1-4ec8-a586-26e3714081b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.229.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7ed5011-a360-437d-a032-f1eff85f6e30", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.26.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42edc694-a609-4b02-a5db-d2092022b61b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.28.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57b1cbac-8085-441f-a80d-9ad28b2a1d1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.5.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1539f9a5-ed96-4411-b529-845370eeaccd", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.81.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f87a3dd-2404-4096-9dad-1a794c89a7dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.52.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2f1d423-c44c-4d35-8ca1-be5991b6d631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.52.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e08648f-bcee-481d-b9fd-90520175545e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.52.99']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67ee8ef2-73a2-41b6-854b-52a7ccf30357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.56.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64047db-9847-4d2b-8b39-17e5ead38c38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.235.61.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb17212-aabf-4eb4-9b13-679cb5d239c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.214.243']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--120ec3f0-b065-4a54-b43e-b14039ca0a7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.217.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae4fdb9e-3d7c-4383-b138-a56661928a2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.217.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc784fdf-029c-4057-a763-1ff39a2af4e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.175.92.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--108c2272-45d5-4bc9-9ca1-371961c789f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88b19a25-fb71-4e9c-8596-c6dd82dd49f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.119']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0424d16e-b691-47fc-876e-345fc8b088e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.129']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28a02bc9-030c-4d1b-aed6-b2610866879d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803b62c1-30cb-4602-b9b1-e5a73dd5564f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7bfdb7-36fb-43bb-8a2a-f447c7e911db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--769a26fb-a043-418e-a5c7-2e3ec193166d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.135']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30d3814b-d27a-44e6-9163-adda2e823cbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f49d9585-9014-404f-9cbe-4f1619fab0da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dd0f86f-1650-457b-8aac-a798e4c4b465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e841e6b5-8e17-421b-a849-b3e54e780ebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f22d91f-355c-45ec-a60c-dcd2d7e0a461", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.140']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e821eb6-80cc-480b-8ed0-2d4ef0fe1692", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a992847f-cb37-4f99-823d-89e88a358675", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca7523c9-eadb-45e5-b075-c30dc3b7e08f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbb72513-44f6-4af7-bba1-343a50741135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3e47867-c51b-4af4-80d5-25efc040b273", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--813af638-3c97-4f32-8dd5-08437adfcf4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e49c430-fe14-44a0-95f1-8c2aa0019ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5032326e-bf81-42f3-817f-48eb5b60a772", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d312386a-5afa-45b5-91bc-d7b751df8360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.159']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--592b1cb5-f165-4898-93ce-9d9167c26cd9", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b652d02-9cb6-454e-8144-87e5c096edca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.160']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f028b334-984f-4354-8620-2e3fceede59a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.161']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c9d878-c33d-4792-a4b2-a2575c92784a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--830e970e-04f8-4c42-9ad1-b6143d280610", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a97b06d-72bc-473f-80ba-3ea67f16bd4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84e2f535-3308-4a06-8a24-a0e1f07c461e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e708be42-f5bd-493f-8127-3290d0c54a93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54812680-2a34-4630-ad8e-aedb7cf7d8c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.173']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34653479-aa1c-4197-9d32-7e30b06d38fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45568f5e-061d-43d2-8ddf-e61236fe920c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be8c8f07-a4b7-46d6-81df-86864a58a403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.176']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d05965-7217-483f-8697-a0142b39d241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e50e6e16-9487-4fd5-8fb6-441aa115e409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.179']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--718e8ceb-b459-4110-9c2a-2a5acaac6df5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97e29d94-e04a-4ba5-bbb0-25f69ff9339c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e64e415a-4c9f-42b0-aead-105fba0dc3ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.183']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e884a01-cc25-4e60-8aaa-db4ecf6ea8be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f17b25b-ee68-4680-90a7-d1d2786ecb13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52830bcb-1213-47a2-b922-429e6f5292e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.189']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1172fa96-95a8-4aed-a0d2-c794d246a9ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f0c48d-26b8-485b-a163-016b94f94a57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce18864-326f-494e-b73b-d80c2e42620d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d480c17-7ea0-4490-a302-e7d6f4fa3b00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de6942d6-04dc-4d47-bb0f-25c34cf225e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e36b71fd-80cb-4c1d-8a06-85b19e9bd3ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5692fd5c-49bf-445e-acd2-e5427506bcb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b1ee2cb-d207-4e94-8e46-050b5158b69e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53fe0eb3-d0e0-4169-9e5d-d65a77ef1e76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eecb3950-9925-4fa7-bf64-481b4994f584", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d39caab0-495e-4d1f-b69c-80d96c9b60e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8b0584-aac7-42f0-81e1-0781652348c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53706b53-970d-4a3f-8762-d83894c91c0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--874107dd-e4b9-4b09-9649-147e9f81f0e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a2f22c5-75c9-427d-b67b-fb38684ed1a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b64684f-7317-4379-8e4e-991aed0c1491", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76a082f2-fc16-4b90-8a31-b00f1a5c8602", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ff0fae-80bf-452e-8ab5-3ba120bc5cc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6354b2f-37a4-4ec7-94d6-d55fe117aa21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.224']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7462e24f-4216-441f-ae05-f4181f097e1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.225']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e4c1e90-b3a9-4ed6-b482-2886509eb1e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6694527e-dd22-4815-bfa7-a30c28b355da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.227']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b4a85d-583c-4aa9-84fc-71abc1317450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fcccba3-2058-4db0-b828-64738b1a297b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--511c66b1-c1a2-4f59-90f8-620db240fe70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--272e3eed-5cc4-4402-9f57-736628fd6710", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d911ddd-668f-4d11-871d-a8e49844e653", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7788f156-edde-4f65-89c3-2e3e525a3e66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--012c4376-2a4d-427e-a905-e1e913af4b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.237']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e2fe9e5-52d3-4803-b731-000a2c5d391e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.238']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bd98d0a-d7cb-4ee1-8a37-211a8690dbf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40e2f950-1243-4847-bbb6-6bfe277e5350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.241']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2980892-3228-4b01-a2f6-960088a59f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01053845-6ffd-4420-b90d-4425bf988df5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18836d87-4c42-45aa-a248-ff2286014c51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.247']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7bb56c6-79f9-43c7-85ae-337e603c4d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.248']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a07ac76f-3ef9-43a9-aab4-bc9305fb3d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--698927c6-71ae-4f9a-92bd-d1e8241160f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e3f6c91-a21c-4104-a40c-d7da9c0076db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7470b777-3a63-49b5-8599-aa4c1fe23ea9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.253']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaa73f07-832b-4c66-a809-642c815a7bb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7259f608-ec14-4e80-b5dc-30468d4aa54b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3afe6a46-b163-4175-adfd-b28fcc7a92ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68991caf-617b-4cb6-9781-75a0317ee032", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ccb9cc-2540-4ca7-889e-7d19e2713cfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75bfa1e9-955d-468f-8f2c-927460514b31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf13505b-1f01-431f-b7a8-c806ea3f462b", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.92']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8809fb-47da-440e-91dc-f13d46d381df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99062025-9fd0-4d3a-bb58-6c1bf9224272", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '70.164.4.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5331b9b7-9e87-4cfe-ad22-c30a1123a69a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80214fa4-50e3-457e-8495-f81188f4b04f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d23a863-f1f2-4a15-9a4c-faf9ab508a2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.232']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f63ed8a-4891-435f-977c-a172042fb9a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece0d464-4e95-41dc-910b-ded149d4fad2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.234']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18f4e7d-79a4-46a9-9cc9-27720b577fd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9f82ba9-2a2c-4901-a1e0-a4b5ca2e90bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.135.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aab3a1d-2366-4ece-96dc-b343cac0e4e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.146.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a74af707-a823-411f-88f5-90923dcdd631", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.147.254']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a64c3fc4-486d-49a5-af5b-afd5c7cb0421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.167.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--641d3d52-b2ff-4b87-bde0-244383a5cc94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc08b647-4a79-4fb2-a036-d059e0dafdcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbb9f259-58a6-422e-ac5d-03fbff1e7435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b66de1b3-ef01-4a97-8648-3112e95a825e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92b07e0f-cb76-479a-b7e2-f1a20a8f9e11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb67165-72c8-452b-a0b4-765d7065196c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ff19dd0-6915-419a-be23-421cd309aa82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2101293-f991-465e-a91f-9ffeea0b473b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d2dd76b-9f57-4347-a5fa-26d32dd7fe5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.14.178.148']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b06c01-18f2-4592-a063-2ba223b443e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.167.226.244']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05235a1d-31d3-4c40-9b06-6f15aa3bf0ee", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.167.37.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5f18b56-bcb7-4d3b-ab02-3feb73d12a9e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.240.125.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d15406f-264f-4c7d-aaad-ef14eb6fb147", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.80.203.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ee1fb41-3d67-42b8-8a01-7450054fb82b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.204.137.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275b18ee-2404-4e96-9513-ae13c11478e6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.36.177.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9fdcc1f-ecf6-4a1b-90f3-9f42017c1c20", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.162.64.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529a3e6c-00ac-4695-a79f-d09d7ba2eb0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.253.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ae75e25-c3b4-4ec7-bff4-4307fc095b7a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.208.238.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c6d9b3-5129-4872-8b3e-f485a4a90944", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.213.245.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--838277b7-6a49-4854-839e-2663f48443c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.100.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71fe4c7f-b4b2-49ec-894e-b5ca4b512347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.121.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--567d0795-8b79-48da-8fc0-15ba98e93630", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.185.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53d6d692-e98c-44a3-8883-774e7a7cf2f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.205.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--518c4aa7-e0d3-416b-9637-12612299f160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d38e680-10d1-4396-8017-38a76044457e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.233.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616c1bee-088d-47eb-bdc6-006db1006799", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.227.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ceae75-5033-48e5-b580-58cc33716a6e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.230.1']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40b6d679-7c56-40b9-b585-44dde7ec3d94", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5781b94-b6b7-4bde-9dc9-c518fbf93851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c30c211-4eef-4a6b-853c-8837d02002ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fdba83a-c860-4ad7-8d55-496e81fd98b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe555c8-841a-43ff-9679-6288acc21e4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba7697e5-b30c-464a-a702-50a4bfc1fdb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b67625-3a31-45ec-83f9-2a2c891f2664", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03b44ca0-745a-4c39-821b-f52d816e65b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f6a0311-2ece-4da3-99ea-5563accabf98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e04b8e4-f242-44c6-987d-fa02b79ec749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eea0c6c-8bc0-4727-86cf-fc6a6d086d3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f6445b-3597-4968-8289-f47d16085ed9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d02575b2-be27-4092-90e2-172724d0b4f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--124fe4ee-2de1-4d3b-a11a-d4e3ba3e6a79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2bee164-9239-42b5-92ca-b89f2fffde07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c37da4ee-242d-4bf6-b42a-ed762f871a0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce4eaacf-29d8-4237-85e9-142cd778a4eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c49b94a-b6f2-4df1-9b14-54ff0b3e4956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b560448-253c-4668-a971-20b9c5bc368a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.111.120.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c51e7334-695d-4460-8e44-5bcd253bad21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.40.160.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8893a8d9-0000-4300-960c-35a71df1fdd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.39.119.122']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20897e30-cfe1-498a-83ec-0393bb20c55a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.124.98.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38f20db3-f368-43c6-b335-fc9c61b74dcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61f924b6-e7f6-4cb8-b80a-467b0f00a960", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd133fcc-d577-4d2b-a4a5-b2cba6e18e1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e67842-8134-4400-83ab-2f14f4bfd364", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5974c8a5-5762-41c0-b294-2cbec157bf94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.89']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c2e6b50-9d49-43c0-8484-0ab396d98bdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e97fb2a8-9534-434b-a331-0b78df470f50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--056fb2b8-ad65-4212-a089-378ad3472f10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7814a03f-3e4e-4f27-8938-06bef554928d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.112']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e012ffe-6122-4ccf-be4f-c99b91178a3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fce16691-041d-4419-b920-0082b55ed97f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.246']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3734c2c7-b9ae-4558-96cb-3a42c26089f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.30']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f449e08-417d-4063-946d-863eadb4ae7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db55f26-b635-4398-8327-c9e0d94acd59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f2cbd02-a47d-491d-bbf0-39ba170896c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e379147d-bae9-407a-9d98-424c887d84d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95bd803-a69e-456d-b70b-c8299ced148a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67449644-8946-49a4-9a74-ade87e29eeca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--629af1d2-19d0-4f6e-b326-a8d548a78045", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aace36b3-5d89-4b78-86f5-212bfac0e7ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--216d3f93-49c7-49ef-a7f5-5f5f8bde83c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--409dcd04-1598-42ee-8549-56566c6b462c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a01832c-0bbc-4247-b74e-9bb4cc40e815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b6ce096-8333-4faf-bc2c-de430cc366e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.159.131.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32a6fc2d-67f4-4b8b-8b7b-3c95bbca1f9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.17.70.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f56725-f91c-4d8b-8f26-fa153982eb6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.110']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4851199c-85a8-468b-95c0-1c311fa0c8c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--037abe04-d3d0-4ee1-89f1-a29856c127d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8bc633f-dc03-4c35-a5da-2010518d304a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bc4d4a6-29ef-4d9f-b1cc-6f15d5581500", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2021-26855. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a489deb8-edad-4efa-b48a-569b98ff76e7", "relationship_type": "indicates", "source_ref": "indicator--8bc4d4a6-29ef-4d9f-b1cc-6f15d5581500", "target_ref": "vulnerability--2da8283e-51cd-4f01-a124-d12a7d89b0bb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae4e6ac5-f44a-4f0e-bac5-772f8c1c9c90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d0af5d5-a256-48e7-9a5d-f14786afcd10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f71bebdf-2092-4b25-964f-6d3c2d94a878", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--817398ee-8eb2-47dc-94bc-2a7e97b908b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f6045b-eae0-41c0-b9dc-a17f5cc58161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1576a5c0-5b7b-4a6f-ad06-c45be6123659", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.58.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6af88a1-b188-45a2-a343-524daeeed4fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.58.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1351a01a-b176-48d5-9789-6249df4f0c05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.59.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfa03b09-f280-4d7b-87b7-028a9a1c4287", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.60.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d9cffb5-0ba2-4c18-a86d-2d0d21502014", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.126']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e95d151-583b-4a8d-aec0-5e51919db572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb7d540c-9412-45cf-ab16-7d5339df3cba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39f3842-a3c5-442d-9179-ee52ee2cab67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--740dc0a9-a54f-442c-b431-78a89df13a8d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.16.252.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5ca5713-b7b0-4858-915f-f9c782ec805a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.177.141.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0e3732b-a8b8-45b9-9eaa-2b9e8dc06e89", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.6.181.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f63467a-fc5c-46b4-9195-fb3861b08747", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.130.148.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba14fafc-8304-49e3-b1f8-cfcab5c5c6f6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.131.79.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--424163d4-9231-4376-97c3-c10e820849f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.134.159.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a212c294-7e8c-49d1-a004-f3d2e0bf8710", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.154.2.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8adf7c3e-b93d-4110-8b10-9b19ce80763f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.208.10.94']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5693e939-88e5-43e8-bd6b-4dd8db1f0c78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.110.240']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1399509e-2afa-4dc4-877d-488e80b7dbf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.201.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a12dc20f-c135-43ca-98c5-d04dffb05e8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.210.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18a8c46d-e930-4b33-934c-c56b121e1d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.211.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f023b68-2616-4c5e-bdad-c17328c82b3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.238.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b95301-48fd-49a7-b5b9-128472bc9763", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.68.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99e91b79-0783-4594-afed-16c57cb0c3c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.77.162']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df6b354-c051-44dd-80e5-56c44f078f3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.88.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b2a6c7-1619-4722-95d2-e72971443820", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.96.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e932782-748e-48c4-8884-95e16b5fd66d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.0.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ed86070-bbf9-41de-bc45-7978ff15c258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.12.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c920c3b-ec5b-421f-82e2-07f610971e84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.12.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6abbc48-33f1-4bef-8046-f334e9222837", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.144.142']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb7246d9-7b86-4107-b8c7-e0be9534782e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.159.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43dfc341-c575-4060-b7ec-519f60423d17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.26.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238b3daf-04a8-46ea-9acf-2c1bb6710212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.27.88']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f801883-c7de-42ea-9187-682114244556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.33.96']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362e3c0a-0587-4a7a-ab53-c119e29f563d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.37.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f68d266-30cf-4e63-ab76-728c524a72fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.4.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2da0e03-dedd-424c-b719-f568648e5b9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.41.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--954640a3-7775-41df-acc9-98c4da74dde9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.42.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc37e5bb-460e-45cb-ad4a-0248de961e52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.42.229']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e17b80dc-69c9-4766-aa8a-6daf8a717ac6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.42.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b555038-4fda-473b-aa60-5af45b62b718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.45.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdcaeccc-321a-44d3-80ab-aeadf262895b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.46.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca7f8928-f322-457a-b46d-f4e4b146eeb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.0.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6abc1dec-8ae1-44aa-b398-a34632165574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.1.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--377e3983-ba41-4f83-ba6c-0aadf436264b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.11.223']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04bc50f6-a4d5-420a-b601-7a3a954e4ec3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.14.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--047abd41-7d87-4614-bafa-15a8a9971cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.14.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b709158c-62f1-415b-9be6-c6e65faa1176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.15.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76259076-df66-4f90-bb6e-f9c3344427d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6bbac84-d359-41ff-a367-aaa379b09cd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df0f4c60-af26-4cc9-863d-ac4618a52265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.105']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ecb531b-62b5-45e6-b54d-4b20717a6ccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e53e6d-5a9a-4074-95e3-296307c4da68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.2.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f725f5-5ad7-459c-836e-effe61aebd95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e3f655f-7753-4315-8c24-829188715cd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba42301-2003-44fe-bfd3-8d290ec48afd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c680b92-6229-4f2e-a75a-491217062d12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.102']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--775bc3cf-9bf1-4f7f-bd65-bc254b105e55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bb6fcec-ccd9-47d2-9dd9-48e06ec78d54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68bd091e-1e14-4c33-baeb-24939d4f67c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2eb167d-fc01-4b27-b28d-e933bfefbc74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b5632d-9082-48f8-9f36-c159124d81cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b779a473-f908-4006-8ddb-a05c689cf4b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--873f2e6b-c29c-4f49-9ec3-6dd428829c9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.175']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c5da7f-78e0-4c97-8cac-90cc3082c1d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d308dbb-e255-485d-bcd8-de1a3db21785", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--291f1e30-bb96-4391-9559-07385d2abfbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.91']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71f42f93-6c48-4d2b-b97d-67c99f695bad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ee48e8d-a786-4ce7-b54d-a5ab1104547b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b583bef-c9a2-439a-9962-6acbb51bb0d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34feb955-65e8-41fc-8a78-a8005df087e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.8.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da41ac8-4aae-4c9f-8364-ee2882b22819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f25d2b3-3db6-4a77-9e3a-15c45eb20aa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13d4efe-d363-48ee-a80d-1109f8341108", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.218.188.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5e90e37-31f3-4874-80e8-a44d32dbd1c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.117.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f171e2e-66c5-4f5f-b739-74e58f8c490f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.222.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53ac3179-2fdc-489e-b0b1-1d00750e2163", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.68.3']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c3bba6d-af4b-4ad8-9da7-ccb015ea113f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.82.137']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d84880-d61d-4801-8f24-1d73034de492", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.229.220.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e73d887a-7c40-4a74-8f02-2d7858ff0be2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.231.168.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa7b6a6f-7da4-4417-9fb3-63ba09f43c0b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.243.15.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f91035a6-c5ea-4cec-83e7-90682881cce6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.158.109.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--420b6975-fbae-4b92-9566-a304c4c53f04", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.241.216.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f9796b2-d5c1-4a53-9451-68a730bf094f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.27.74.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68bd716a-17fe-49ba-b90a-874e9f1bef2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51aab9a7-494e-4e3b-b41b-0078498575b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.66.83.80']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2611be58-7635-45bb-9760-120042611b60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.133']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1894710-de3c-42fc-b526-6556af5c93eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.139']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbc8fd1b-3436-47a1-9577-703e4590fe8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cffb3c5e-ff54-4cc6-8561-0966a642b6aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.85.246.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--518bc588-7ede-4334-8fcc-aa538c679f8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.87.206.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f515d20-4e85-48c9-a724-b6eb57d477cc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.164']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f02d7f53-bb5e-4990-af80-bc87bf374110", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.165']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17f4a64-1fc6-421f-8ddb-a41a140bb799", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--995e095c-f32d-4fc1-986c-721905a0c2ad", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.167']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e482c97-9853-4a9f-b1e7-66b1c10b6796", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.169']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.171']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d889144-7688-4dad-a27f-d477f64d6988", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.177']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f433d181-1760-4276-8986-bdb8327cd285", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.184']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05627449-6a19-427f-84f8-d9a4a3e753ba", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.187']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--131fc844-472a-42d2-8649-161de7200ce9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--011c5b96-f4b9-4f9f-a293-faf74c2eb24b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.12.198.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a839ce4d-9ace-47ec-8574-5e661075eba0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.170.248.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c97bfbc4-8b24-4723-b12f-70d00ee07bb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00457107-5c88-4dc6-86f0-cf35425f7c47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.214']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcebe8f2-8b00-47ba-9000-0c8e77592e82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e1cff6-88f1-48ed-beca-71a64484806a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.19.219.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaf199ab-41c7-4e15-a017-3860830c5a1a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.192.46.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--048d08db-8ecf-4f2e-be1f-d64963c07fec", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.199.60.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7357b6a-8d7e-4377-9019-5283e2b2ec6a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.23.173.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4201c441-8f18-40d7-93d0-88e6dabfb76d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.205.101.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4792ab96-e1dc-4f4c-b377-04788c92d53b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.29.130.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbee35e6-4611-454c-806a-c1547ed38ea0", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.49.2.81']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d65ddd0-cb28-402c-9d45-de0ea9257715", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.64.200.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86dfdda3-dce8-44c5-854f-ac38b8db315f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.67.107.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5b7551c-62f7-45fa-b302-e745eefde268", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.118.88.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e93da8c-e0aa-4a9d-94c3-8674e170f0f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.46.107.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b93d460-2409-4651-aecb-ba8bf7761aaf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.46.247.185']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c826a1-72cb-40b1-927a-71f2172a4e52", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9256162-e132-4e9c-a820-e977c032930e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.130.230.220']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de387b1d-ab81-4414-920c-c4c254218ac4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.192.31.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1df2999-f287-464d-9ed9-9cca56c8664a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.198.247.230']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b16ba70f-b4c1-4545-b253-4b61baf8a301", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d94d7e-1828-464c-9119-700fa0fe6255", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b8ad4ef-9f0b-43ad-a8d6-be5ba87f8c5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2ffb6c5-0b46-4a80-9e42-da635b6f7419", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3820bb-f4e6-4835-87ba-a5bc48a1e99b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e497f96-f94b-4a4a-862d-18464563685c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70657191-7cdd-4a26-843f-f7134f7371d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f0ed880-3b55-44e9-acae-b8fae4af423e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e2d5682-ff78-4551-b943-98ecb1d274db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a313c78-1ecf-463f-ad31-be9ead79bf16", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13749521-1e1e-4c89-add3-186f7dd22253", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad958c34-8ff9-4cf4-802f-cd9fc8762b56", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--494c3649-b2d4-4ec0-8a69-c075f4ae6f84", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--104ab9db-6e6c-46db-a029-6a2c7a2b0e6f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c0a635-6ba7-4b9f-b0c0-66fe89fb5760", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eb0adba-143c-4644-84a0-e92f60705584", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f12e1d0c-a806-4d04-bd57-132c35cbc9c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eb4378f-92dd-47b3-905b-4c2e0df8cc9e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a087729-f116-4611-99c1-f02d56a5ab9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a578369-6069-4f52-8be2-09dfb62c4e1b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cded2691-d4ff-4ba7-b5d5-299c5e887660", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc0c1ba-a478-43fb-bac6-494c6ff8b910", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42951e15-a7c4-4e9b-b285-d173046eb5a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b4fde8-0bb9-40eb-bb01-63292b6b34a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b773506-6472-42ad-8874-fb0ea1dee530", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24b5a12c-638e-4c4c-8236-4aae9a8ac833", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6429f2f3-96b5-4fe1-9469-705d450f35d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccd6b9db-7b4e-474d-9d62-38d3d4aa4e6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.11']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea471d09-04e2-4603-9c74-cac2ce2987a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad471e5-0731-4b19-bb69-82d389c9fdd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5608a1ef-f470-4507-aca1-ac524ddeddcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.15']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f6a390f-0dd7-46da-9ace-3acd0d8a8149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0e97509-51e1-407f-805b-9e64a7aa5fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68f280fb-f511-4c0c-b167-5bf61b16d67d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8065af6c-1c71-40c5-92ee-19b9876a8034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.2']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0a57877-8851-443b-b57c-4477f18ea347", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.23']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fa4ca6b-a93b-47a7-8304-adaf28506d79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b7b9ed8-b562-423c-a8e3-8a96221f08f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d325e1b-e756-46a0-b333-951dae8bc303", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78ca1e9a-d9e5-4b57-9001-4f1261bc227a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bcac9f3-a1e2-4f57-a58a-52757d184024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e671ff3-572d-4dfc-9193-5bad02fb8edd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e69eb7-c8d0-4603-917f-da1e3d343342", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--161ecd48-e5ad-4f52-92e7-56f57c359ae1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--669d0d3d-1c7b-4ea5-a3f2-506d42a696f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.37']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f2e689-3e9a-4a5d-ae05-83e5b394f2c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f175b7-0768-4738-b817-37d75311ff65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.39']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--643b9344-1dd1-4cac-a64c-0d3faa515db6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f19c3d4-f464-4e08-a92c-4b53d14e8116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b9c90fb-86b4-4412-9296-0d463ec3b053", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b923d4-9444-46b7-9e34-ad9f6f15f935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e472191-e2ba-4b71-9fd8-23174ffc2436", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.45']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19072a09-ece8-47a4-8f3a-0067e38035ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e57ebad-64a4-4550-ab28-bfdf348de139", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a341d770-3b0a-43b3-b086-ff936189f8ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63cdcc44-6eae-4cde-90fe-029248a597aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.49']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f93618af-20bf-4b39-9ab6-4479454f1dc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e25ac42a-a651-4bd6-bb30-d8d488cd086f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a29482-f183-424f-91d1-826480a0bd10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--469bce43-306c-4cab-8232-822d6ca14cd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4357166a-fed2-4a42-8735-2de1a931eef6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298b10cd-61f4-41ca-9047-c5fda302adb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.8']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f0e180-1726-4272-a966-bca8aebef694", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--809a8b13-21d0-4318-81bc-892f096c2bb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ab8046d-a7b0-415c-bd39-29035736c70b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98914aa0-4e44-468c-bac3-bbec131bdf57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb0ec427-0311-469a-836f-b61cdcc38cae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.13']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9b88bc-120e-4722-a358-f69031e9de4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.16']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1e1cb98-7594-403c-9efa-b938834c4ba4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51f43b59-9c1d-43f7-b8d0-27a355a2383e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.20']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ec3037b-5143-4200-a199-c9cf4e7c79d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e731469-33c2-4c5d-a633-1424363f2a46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fd1e136-ceba-498f-82aa-8d3cfbdc48fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8abde826-d628-4dda-b1e0-f06a86e92954", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17577c63-56b4-442d-b8f6-39133b586212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fec0561c-ec77-40fe-99e2-7d307de00fc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.33']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c4a487-9db4-4e15-ac77-7150f6cb49f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37172f04-62f4-480d-94f5-4574f35135e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373f35f6-4e02-4720-93d6-730bbf6b4ca0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.41']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7399e001-692a-4f72-9d2e-2c41dcb0de2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bd2642b-2ed2-4ae4-a481-a539bc2811e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63764917-60ac-4075-b2cb-705c57422940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.47']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--963cf956-8f7f-40a3-8820-dbeae87f86ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6d07b2-94a2-4657-91bc-da22f9d19bc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.53']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63e78e78-d131-4efe-97f9-9ffdad4373be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.55']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34d1c56c-0e10-4d8e-8489-14c29e468276", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.57']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd5d11e-5b65-4910-b54b-ec2990f3290c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.58']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4bdb660-636c-48d5-ad45-81416a89fb52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b022d7d7-f842-4ab7-b771-0ec9844aefb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a9e24b9-7bfe-4565-bef9-b7fd57aa2097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.60']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f91f592-5b16-4b16-929b-be4aaeaec464", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.63']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dee9d6ba-8211-405a-b4cc-4d0ad211847b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.64']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6aafe75-a0c2-436e-8837-146d3c89c48d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e21e5e-5648-4c2d-ba80-fc59ee0feb4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.66']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8bf49c5-ad6a-4812-82ed-1f506c4bf806", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e3ac248-c05b-466e-8150-397fb394201b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c126abf-3e20-48fd-a89d-504c0b368791", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.7']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--415f2008-751f-42d0-9715-3995e4db8307", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7585c7-1c7b-4f81-93b9-e990df01b428", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2495b5f-0965-4da2-bd30-792ee93aada1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.74']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--898e19f6-99b1-456b-b916-3f514079f0c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.9']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2974e08-23d5-4990-a937-52154138ed44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.243.74.24']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3c20e2-d693-4223-a7bb-35d18007ea22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.62.36.43']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de5b8e0c-1fcf-4627-908d-f7f643181889", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.96.171.0']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3572e76-050a-491e-94d8-14c920170a17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.106.74.245']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f58b4024-49b9-4422-a8dc-8548426f1c18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.111.176.100']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43130913-36e2-4c2e-ab7e-e08718d1b529", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.246.231.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f74eb8-b5fd-4cab-8eb8-466e2720bc46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.32']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6916c5c-3b08-4db2-b916-7da24fbeafe3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f157428-8edd-4dec-bd43-67c6b324fc6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a6e48cf-4548-41c7-b77d-da7fa2ce4365", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a66496a-e331-4515-bd00-3f433b08d3c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca976a7-8a4e-4e87-b577-f92bc30d3dfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.44']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1e1f09-2522-4dd9-b0d7-523fd30221a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.75']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--325df5dc-3666-4b5c-9fc7-4e89b22a54d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.79']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d7f2cd-1314-479d-8575-cf61eecef06e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c785901-119b-4186-9add-239de4feb021", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac3332f-f0a2-40f3-a703-b70428ab9ece", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.40']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3cdef3-5b52-4999-b98c-9c335280f114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.50']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--251fa5d2-0f6d-485f-8ca6-a399432c0366", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.56']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ab68cb-ab3f-4419-bb14-eb9fa829f947", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.67']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e834151-08f2-40a8-a88b-552e4b27557b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.77']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf67e66-420c-48a5-97d2-dab1bece2b1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.93']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a71625f1-d745-423d-bc74-f1fe2893ef9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39b55695-2197-478d-b46c-ebc3a09eabff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.68']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71724db9-69ff-4c48-b35d-e8ea6f5e17c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a24ce43-bbf9-4f8b-acb9-cf9a11dab63a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76cfc910-0210-475f-9cdd-a20ed858596e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eb8ceb6-9566-4ea5-99b0-ec8df124df5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed59830-5ff9-4c1f-b66a-83388e1937ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--372915d1-b9ea-4a92-b6d7-cd85b2e79cb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.88.181.78']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be7f329d-994e-428f-bd03-484f2bbe0cfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.135.73.205']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8243b4-b235-4a5e-a0a2-a0d71b8a6c85", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.147.30.59']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a37ad82b-29cc-44b9-8dd4-a49e9a396d99", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.180.62.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--515f7661-4ec7-44c8-92db-5816e2b27924", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.190']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b7da4ba-07a6-4780-9aee-b937d5623308", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.191']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9f27fa-2e2e-4c5b-988c-80801fb9007d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.192']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c382f92e-34e1-4f26-b411-6e0ceec5aa3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bef0e4-52a0-4dbb-a8f7-36eafa0ed537", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.69']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea880680-7b77-4960-836c-0db33c2595e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.24.117']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--833a8756-6152-4037-9f17-723ce4e5cd54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.231.128.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--623b2a8f-e89b-42ac-93d7-c84aac613c5a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.84.222.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af300d2-0526-4d89-9f6c-2e14ffb72890", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.110.65.158']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc65d902-5c55-428b-9501-78ee0495d5fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.163.146.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d2a02b5-360c-43c4-be22-12873745b78c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.163.206.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b14a8d4b-4cd0-44e1-86de-db1bbfa817ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.167.124.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5151354b-d56c-4535-a590-978f6257b26d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.21']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7012fe10-374f-4ca4-991e-a8f74d2cb00c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.70']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e80b3cd-1d8d-47f4-a00f-d422b5d375e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.223.0.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa2a480c-8abc-4cfb-84e4-211220129dbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df535b35-cd8c-48e7-9563-7dfb2d9cdee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.200']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--509b23e1-fa6e-4869-8090-455f2014f848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.25']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8015bd-edfe-4684-bf22-79d8c3370148", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.48']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9051e7e-bfec-47e6-9b83-4fd8b4d6b61c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.61']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7112410c-7f5f-4d6d-9a93-2a90a943e1c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.36']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706de1f1-02a8-4d47-9cad-f5990f416b1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.117.103']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f88e70d3-e7fa-4d6f-908f-0f7242892329", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f395587-3649-470f-9afa-94d150fe9c5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.141']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--222df7f0-000c-4709-bbd2-8dcc02efee51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.172.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd2d1259-f4f5-40f3-aaf1-7ac3781d141a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.38.96.216']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f13d7bee-e79a-4103-b0b0-28e9dd876e0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.39.105.65']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02d9bb14-4ac4-4dcd-bcf6-7e751a78047b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.45.13.19']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc8dadb6-25ff-4726-9112-3a44ce20fe1d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.223.176.221']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db346c90-1d4b-45a7-8f08-0b3f88bca13a", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.234.8.54']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66fa010d-3653-4f61-865e-222860bb69b8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.107.148.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4fa4e9f-878a-4097-b428-dafe7229759f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.190.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cba05d6-861f-444f-bc96-6165bca7b5b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b11e8f6-f007-437e-b340-44d951b59faa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.46']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60d5de46-0edc-4059-ab6c-03e470971f0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7e127c8-0d73-402c-a12d-b43d3fa6b460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1a3030d-ea37-46be-b02a-1035d91557b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.114']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5995f4f7-9da8-4f4d-a31f-386b2871ee74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.90']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11a0cb8e-a95e-41c7-84c7-b25775a69c45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.98']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10a024b7-14bc-4b7c-b2d3-2c440d88bed6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.199.163.52']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--626592fb-d718-430a-b13f-478e15ba8f0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.203.177.121']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7569d898-39af-4d6f-bc70-c1dbf3e6b184", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.210.224.231']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7f819a7-8fad-4361-912d-624f8d66f464", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.219.138.72']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daa84efd-7f27-4e68-863f-d58872e930d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.147']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac57d3d4-b792-4623-8af0-0670229bf936", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.124']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--213ef3f2-655e-4247-9886-0657aec955ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9625244-bb2c-4a40-beba-fbf8d03e8ce7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.170']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29328da-73dd-4832-b390-351f1facda88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ae118b-eec2-42f0-92b7-291837d9e590", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beaba7cb-d129-4bcd-8849-94f04bd853b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.226']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3653c771-1da0-4d31-9fc3-f5e7a3254171", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.228']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03b59c0-35f3-411f-8d46-68e57fb52a55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.242']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfa8cbc1-1a7c-4b10-a8fe-91ab6e7b1942", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.249']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4735c94a-6428-4f7e-8a55-43c8d5507047", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.34']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--538ab1aa-255c-4334-b294-6179e9848f87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.178']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06dfc4c1-e929-4b79-88fa-e8c6c84b8865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.194']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6c18df-a19d-4b3b-b5f2-620067224490", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.217']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--489b9180-b13f-4420-838e-5abacf0ebfa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.218']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f53bb6f3-c886-416b-af37-41de66903587", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e54876e4-40b5-4ead-8f5a-2262969525c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.42']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6841f4a-9b6e-4e12-a4ee-82d3c95037d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.73']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae4dd2fe-756c-40a4-a489-15fb958f306b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.76']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--654625ef-644a-427e-8cc5-a50c43aaae7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.238.181.26']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6cf163e-6310-4c4a-9b45-6d04ac7cf083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.24.1.201']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6ca8aa6-dcc4-450a-9ec9-7c70453d13b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.151.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff43a927-dde9-4bf0-a642-809a1b8437b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.80.4']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8468041-cd35-407d-ba10-00e86da9ca3b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.113.142.203']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--550d9d1b-318c-4e6c-a550-96f79f6f2511", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.228.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf4c9de-9b93-4144-87f7-1ac04f70ff9e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.195']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bc3256-b90c-49d3-8e62-62fc2eba0b0d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.196']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16111b53-8474-4244-abd1-cb7b202eb683", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.197']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11ee0614-048c-4dab-bfa0-a476263a662e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.235']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d803fe0-21f1-4b9b-a5c8-a9ced0337908", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "sensor:vultrtokyo", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ba219a-7d3f-495c-bc3a-d5cbc5aa3dbb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.29']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--499190f6-ef16-4e6c-a732-f31ad8d168ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9063252-ea3c-4850-ac4c-b6ff5b7da60f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.128']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42a07f4e-00f0-41a9-b7e9-45bb5a8778ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.130']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1707eed1-75d2-4ff0-90c1-48af8d482f04", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.131']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1dbd31-5184-496a-815d-f9777658dafc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.132']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65d0a7e-c482-477a-8d31-22279d0436b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad47b9fc-c8f7-4bf9-88c1-f2410513ec3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.143']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cad77fc-2bfe-4e42-a7b9-ff3382860a68", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.149']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb0e84ef-729c-48a9-8842-8fc8f0c7923d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.152']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f043610b-b6a4-41db-aca5-1baaa905c93a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.154']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dbc2dd4-1c91-4e11-a278-60c9c3bd8fc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--804abef6-b26a-4683-8656-45a427259edf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.119.36.156']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99614d30-a674-4a1a-8ddd-bdd663272e77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.204.138.27']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0a446a9-b3bc-49a4-966e-39de48e17ea3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.204.138.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e59eb2d9-4728-4418-a4f1-785d6fbd4226", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.207.4.157']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f728bc-9113-4c77-87f0-edc22c2830aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.145']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9cecef5-92f0-44da-8d5a-22fc3a474e87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.180']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0d76e70-1c36-4f37-ac05-59a910cf7f27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.181']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7102e81-4e44-4d38-8ff0-8961735877cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.182']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f26285b-c380-49c6-9275-915118c4ad61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.22']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea76c25d-a5e9-48e5-858f-a4fb42ce04d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.236']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf5554a-3002-4cd2-a4c0-c2e82da3fbac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.63.197.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a519e729-9755-47ce-8c6b-be5a667a6acf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.72.166']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7026a937-c642-4ad2-9163-37e03f86a7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.150.2.138']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dbf6b45-db8b-4f31-a541-02783d1baa9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.208.18']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e99e3031-5649-4b98-9324-4fbf96690d45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.208.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c4d9204-d32d-4d36-bbef-e0c70a790df6", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.38']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1926b33b-b31a-489d-97f2-ac3051baf793", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.6']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f78071-625b-4c04-92d7-7cdd6cdde463", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.157.63.84']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87d0ddc0-c774-4278-a737-09280df64a9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.93.12']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4fdd335-1728-49c7-a949-b1e05eecab15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.95.106']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fac8c74b-bb6f-4a16-8a35-b61729af6b2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd56d60-3643-47a1-ad7b-9f74fa15ed4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.193']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bac53ef3-64fe-4f10-a772-c94f8e95c550", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.130.171.108']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192903a9-0b07-40f7-80d8-848994418a23", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.161.194.207']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bf15f84-5e14-4ace-8787-2b1e96a370ac", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.181.7.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ca89535-fb4a-444a-aba7-f260a8d50c37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9b5db3e-bbf6-494f-93df-be20ad694551", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.155']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75ea1e47-36f2-4ca9-a532-39fc218d8970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.202']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a6dd351-0edd-4ec1-afcb-7b73201b5c60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.250']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e7727e6-2d6c-468e-a60b-facf8b0f0344", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.243.12.206']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cdcc31a-fbbb-4088-91f2-c527c1b8ceea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.250.61.10']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a14a7d4e-7886-4b89-994a-8fdf34cd38da", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.31']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef4d3f2-1323-4c1a-8180-1cf78ba4f16c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.35.140.5']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a7016b-15d1-418b-829e-553ebc049d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.111.230.28']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09b1ae8d-64e5-42df-8601-21c839c99876", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.130.170.146']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cfcba79-1110-4f95-85d8-2e386e63d338", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.15.190.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd2e76b5-7260-43c6-abf8-7a31765a67d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.165.27.83']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--444517e9-1676-4a9d-a911-7996cd1c5fe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.181.234.136']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c676af05-99c9-44a5-bfcd-442659a639aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.181.236.134']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02bb82bf-1dd9-4a98-b1d2-ef38da3ee901", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.214.52.233']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c63a9c-4199-49e7-ba71-a246999b6469", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.0.144']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3216c20d-d6cb-4bd7-b473-185fcbf93518", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.32.14']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad68e99d-5298-4a41-ad6e-bbdf986a9c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.24.35.51']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d208365-a778-4a47-9f74-971213156a1a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.58.255.251']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c436f948-8da5-49bd-abc3-3ed9a02c40b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.85.34.71']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--861a142a-59e0-42bf-800a-2e59ca398f29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.126.101.127']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd110ed9-9da1-431d-bc29-5ebe75fa3840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.126.98.168']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed85b953-6ba8-4cc1-b461-4c2c329d0354", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.153.174']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89f9cb36-07ea-4642-8757-a1a1a91fc06d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.130.115']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad850d8e-6da1-4427-9681-c6e5c26e496c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.133.213']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ca892f-e53d-402d-9bf4-c4f7417f2723", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.141.150']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d146c15-563e-4508-a545-ec68e7abeb86", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.172.97.239']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87c7e47c-a2f8-4f38-9037-2605c91e4d01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.80.4.95']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bcce8ed-5bb0-4750-bd70-b75494c57862", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.85.17']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f7fd5e-f90e-4ee4-adb9-f250c7d5bf39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.89.204.118']", "pattern_type": "stix", "valid_from": "2026-05-17T00:00:00.000Z", "valid_until": "2026-06-16T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-17-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bee593f1-cd33-4561-a779-9f505be6ae9f", "sighting_of_ref": "indicator--1743579d-7202-4228-90a4-37531d2fa53d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--705caab7-ee5c-4def-9a0b-be3f1d308522", "sighting_of_ref": "indicator--7926240f-053d-420e-bac1-a4ffe03cb056", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b0a02aa-1461-4d98-b52b-f35c36b8f2e2", "sighting_of_ref": "indicator--1eb69c85-8292-4023-8101-5d786efe079b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb19004-49c3-408b-8f29-0923092a8385", "sighting_of_ref": "indicator--82efb8a4-439d-4f67-9d4b-7a31a003189b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbd6e8d0-e8a0-4a4c-851d-554d35fb9c12", "sighting_of_ref": "indicator--7fe5a5bc-f8a8-41d2-b691-95a7449276bf", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--403da486-e08d-45c5-a44b-7da10a8c6c48", "sighting_of_ref": "indicator--3eb4b42b-c7b3-433f-bd61-2b45033fde89", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca8b7ab-6303-47fa-9173-492ac3168d6f", "sighting_of_ref": "indicator--8f14c190-72c2-4967-aaa1-d1d7cb2519ed", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--232360ad-2e55-4350-9506-ea6afb940af6", "sighting_of_ref": "indicator--4e4d39b7-fa78-47c0-9200-5aeaa469a5a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e3da7f1-cb64-42e6-9b61-00e07136d530", "sighting_of_ref": "indicator--a3cd3c02-b655-47b6-ba0f-2991134ca9b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3624f9a7-e215-47b9-8448-f25d9461a266", "sighting_of_ref": "indicator--b56b59d8-a414-439e-a46f-395d0e9d4bee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dd52304-5a7a-4845-8767-4ec942f274d7", "sighting_of_ref": "indicator--7698a03c-3278-4ff3-a870-39fdcec4187a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a829b6c-d5aa-4546-973a-86c80baab558", "sighting_of_ref": "indicator--23c361af-59d1-4b3f-8cf1-5652294d6d46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719d8f64-f059-41cd-bd9e-a46d55784cf2", "sighting_of_ref": "indicator--5259288e-f8b8-4e5c-84c8-15f15a7066ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e6e229-d0d3-461b-9806-f813adbed8c0", "sighting_of_ref": "indicator--f075a1a7-4a8e-4b8c-85fa-c3045b6bcab6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--222388f3-648b-483c-94c5-3a996159de52", "sighting_of_ref": "indicator--9de91739-3a3b-4be9-b4e5-34117bbaed5a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d80cddf2-3c4c-4008-b844-035aa0200bc6", "sighting_of_ref": "indicator--4f1f51d3-2aac-499e-9315-497e5458d76b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac9a2f54-85be-4009-bc6f-2a226a92764b", "sighting_of_ref": "indicator--94e3ddff-6797-4382-b601-c4db231718cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda14aa7-e734-47d9-9c1a-6928f620685a", "sighting_of_ref": "indicator--9523e930-9447-4ae8-8993-d6dde88d3ddb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--affe80f0-bd80-46e4-8454-3b83aab5accf", "sighting_of_ref": "indicator--5a3d2960-2340-4d6b-89f4-b8becb7671d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f79cb334-a862-44b1-ae3f-2b7486ec2b13", "sighting_of_ref": "indicator--d9468d5d-4c59-47ce-a131-738fd1eaec0f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--128cdc42-3464-4d43-b25a-5498a970c16f", "sighting_of_ref": "indicator--2171f1c2-a201-462a-91fd-d8a59000fe2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f38e509-e83a-4c03-83c9-00f54867abf3", "sighting_of_ref": "indicator--8520e6ba-aa15-405b-8a3d-58fcdff57cee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c0c868e-6258-4d0c-8e7d-b501d8a013e1", "sighting_of_ref": "indicator--e4602a9e-475f-4f35-a9c7-21046e991de5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--646b2f36-ba89-4ad3-b876-43c20e32c618", "sighting_of_ref": "indicator--55afbad7-ddac-4237-99b0-dfc7c622581d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7356fe64-6df2-4a8b-98e9-5b5c9e969534", "sighting_of_ref": "indicator--d4d2e8ca-92f4-4755-a1bd-0e03744835c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1153101-c30b-462d-8971-096b2fe56779", "sighting_of_ref": "indicator--7cab5c4f-f266-4500-94ce-3cf6ceced6c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551b229c-700c-4f38-9c81-a3511161518e", "sighting_of_ref": "indicator--8f538436-7ed8-4a09-b365-c854a10fb668", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e1712ee-d197-48a1-bf9c-76da78813164", "sighting_of_ref": "indicator--5e7f575b-eefd-437d-8841-af6891492e45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97d741e5-7bec-47f5-b0b7-9547ecc8c5a5", "sighting_of_ref": "indicator--292deae9-6810-485f-b9d3-40196f49e436", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef2365e0-7576-4f40-98bf-abac16fda558", "sighting_of_ref": "indicator--ebe6d5dc-8924-40e9-87c0-655db8a5e7e4", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e063ecb-56ec-45f7-aa7f-f5a8d7c4a710", "sighting_of_ref": "indicator--45805681-9b90-426b-ab7a-83b10110e933", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e6cb5f-09e0-43e9-bb45-1481f56e4f23", "sighting_of_ref": "indicator--f9bc09d1-7966-493d-a0e1-44e062c5ea52", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a528353c-74d0-4048-9497-2491846b1dbf", "sighting_of_ref": "indicator--5b892035-cc8a-4340-86ba-b65732344652", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c48938e-3d8e-43fa-a5c5-cf478576cd80", "sighting_of_ref": "indicator--7208d26c-9b85-45f6-abbe-919b5d5f805b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe85f39-f012-4856-a33c-371e7841bbf3", "sighting_of_ref": "indicator--2d16bb76-a7a3-427d-a7b2-f9a9e53ebb39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d4dcdef-9bb7-4286-bb28-b35a5b6b1fc5", "sighting_of_ref": "indicator--43e5c5d9-175c-4e98-805e-b240d4cc1d3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7d4369b-1a73-4154-8549-ea68e3f4a440", "sighting_of_ref": "indicator--e3726a38-ace6-4777-a62a-b53da17c6100", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5a2017-27d0-4ba6-a2b3-5acc1168e9e9", "sighting_of_ref": "indicator--6b7ed404-74c3-4901-89c2-219b785d0fe5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab9ea48-305b-4661-90c9-dcae343bde53", "sighting_of_ref": "indicator--0db315db-b281-40ac-8c57-e13fee506258", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2118b5-c555-4ae9-abb3-eb9166f7f792", "sighting_of_ref": "indicator--ac5308cc-00f4-4ac1-a938-c5beac19a892", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d14e519-b111-40a1-94e5-ced4f35b1b62", "sighting_of_ref": "indicator--ac5308cc-00f4-4ac1-a938-c5beac19a892", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd4a7175-9d3f-4aeb-ab2e-999cd791a385", "sighting_of_ref": "indicator--b0582b57-d6de-4ef1-9f15-a6c170aa03cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9fa2838-6e64-4845-b22b-3f0da72fd966", "sighting_of_ref": "indicator--3a3ede10-1875-4d4c-8bab-ad1487280e84", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdd602c4-85ee-4fec-9b5f-16bc09dcae82", "sighting_of_ref": "indicator--664e8091-46e5-47e1-a7eb-fe01d3ab7f87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b52565-ba09-40be-bddf-b7b0e8dbcab1", "sighting_of_ref": "indicator--262ca88b-852d-4676-9403-0775657d849e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b544ddee-f942-4a79-a0a0-a69995aa32a6", "sighting_of_ref": "indicator--7e489a6b-3ec7-478c-aff6-1f5345da925f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe5e921-de03-4463-951f-959ae9ed9471", "sighting_of_ref": "indicator--7689fc56-1ec4-48d5-bccc-ddc9cc09be2d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46159fba-d1b1-452b-bab8-b574c91a27a5", "sighting_of_ref": "indicator--7439b027-8549-4531-9030-ee7420e0c655", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f5ee30-267e-44dc-a44b-a18d0df59ddf", "sighting_of_ref": "indicator--19a36375-023d-4448-bc64-77b843617ddc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a06c3d2-5a70-4aa8-8522-5b216373f13d", "sighting_of_ref": "indicator--791cc4e2-4e48-4c58-92d4-e885f1bb827b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1784d6a-16d5-46b1-b445-d466b7c883b1", "sighting_of_ref": "indicator--0e396963-a4b3-4eb0-b7c8-4453942108c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c075c727-261d-4470-b6bb-800c72fa775f", "sighting_of_ref": "indicator--d9457701-ef46-4996-8e51-e45ed9d9d20a", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54c36217-216e-4491-9cf6-168326f3c0cd", "sighting_of_ref": "indicator--58f75de5-dc15-47cd-899b-4e8f00049ff8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ff1f811-fb9e-40ea-bfaa-820dc2bc7804", "sighting_of_ref": "indicator--53d6226d-a561-431b-9925-f197ffe5667d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21d5b5c8-c75b-40b5-8945-3657682aa0a8", "sighting_of_ref": "indicator--57c54ff2-7dc9-447e-8f0b-f40b7564c06b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c415e278-5a04-4f6c-81e4-5711237251fa", "sighting_of_ref": "indicator--6f49ef1f-aa9d-4dc2-99c9-a9dfa18cb0dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2598207b-b030-409d-a354-13cf99a30fb7", "sighting_of_ref": "indicator--e39c985f-12b9-4978-acdb-2582f49bc83b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0da81fb8-308b-4f51-8d7c-ce30883288a6", "sighting_of_ref": "indicator--e367facc-fabc-419e-a00f-bb110762925e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3250048-5181-4832-bcc8-982ef403d12f", "sighting_of_ref": "indicator--c0b115e0-71fb-4c92-aa3d-26e7f84cdefd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75dca6b-755a-4d13-b877-04b1ad91fcd4", "sighting_of_ref": "indicator--0d7bca63-b3ac-446f-a819-87c4bb47db7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db046dc-e815-414d-861e-88b81ccb0704", "sighting_of_ref": "indicator--fb6551d7-232e-4c38-a0d6-521e3d0c6c7a", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b77a6e4-640b-48eb-9241-c3a586ab11a6", "sighting_of_ref": "indicator--493d68f0-5fd2-49f4-9ab3-6c7563f7c0f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f47efb5c-d3a9-4e90-90d6-9a5d3d4c04cc", "sighting_of_ref": "indicator--16744f44-2419-4ec1-a919-77fbc54c6ce5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96904254-779d-4cf3-9582-d0c337b420f5", "sighting_of_ref": "indicator--ad290950-77c6-4e93-a81d-a8703aab5093", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7519f8f3-6cab-44b5-b3b9-d85d86d2457a", "sighting_of_ref": "indicator--d15471da-1578-4d45-a32b-9a6b6b207d66", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5395862a-d50f-4481-a448-c2bdb0a8604f", "sighting_of_ref": "indicator--2bcac25c-83bb-4f05-81a0-9c958a809c06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8139c7c-bc63-45db-a1d9-e08c20859cae", "sighting_of_ref": "indicator--67a219ce-a5cf-4872-aa83-b36692c3e2f1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c35b68a-ca11-473f-8490-7a7b2ad38069", "sighting_of_ref": "indicator--ba442aca-2263-4374-9664-42897022a3e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbc495ef-66fa-476b-b70e-ea3911d86408", "sighting_of_ref": "indicator--880a0f25-0b39-4775-8117-00c9603e7c32", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8500fc5a-e88a-4864-9f67-bf3d010aa78b", "sighting_of_ref": "indicator--a1866938-5853-4e2a-b0a0-f06e33755d42", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--771f6090-06bc-4eea-8f82-d316edf00203", "sighting_of_ref": "indicator--f64733bf-19f5-4ea9-9c51-f333cf73fc71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0562cdda-0544-4bfb-86e9-2cac5ab16cb2", "sighting_of_ref": "indicator--395af791-2be9-4ab8-8fc0-da9d73d4b23a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93b55719-5ac9-4df6-a6e5-1527e063365b", "sighting_of_ref": "indicator--7bb2eb8c-3892-41be-8dea-6e3822317507", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dad89292-f677-42d7-880d-db08d539d3d7", "sighting_of_ref": "indicator--ce3479a4-1a26-4ee5-ad14-4f8045f65c18", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a2bd2b-0a17-4e7d-a3f9-0dc0a4fc59e3", "sighting_of_ref": "indicator--a515f22f-85bc-430c-af41-53ad1672e754", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--090bbe18-bb92-4f20-a6b5-bc600036f588", "sighting_of_ref": "indicator--dac77478-0dcb-45bd-9b4f-f96fd5b7598a", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c00286-e8b0-44fe-89ce-9246cff9cbd2", "sighting_of_ref": "indicator--7890f513-7d62-4151-95b9-a3eb77ecbe0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22ac784d-5f03-427b-ba10-abf18f19c761", "sighting_of_ref": "indicator--df8a2071-b5a7-44cd-bf27-c21b33c9d3e6", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--554962cb-ad68-4cf7-8608-892944d64d3c", "sighting_of_ref": "indicator--5c88dad2-7ffe-478c-b35d-74993dd2dc56", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6bc6934-8358-44ca-84df-1af47cfcd4a7", "sighting_of_ref": "indicator--f6fcc9b8-86f4-4249-af60-c333f722c578", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d78c6164-30b9-402f-82b5-185bbbfb6ded", "sighting_of_ref": "indicator--5318d50f-6f78-44ae-925c-f9fbc63797c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--476e056c-e135-49be-9557-3197a8e24b9d", "sighting_of_ref": "indicator--29cd44c4-ad97-4f5f-918d-e54df96461f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cb831a8-0a05-42c2-9015-5b6e68094889", "sighting_of_ref": "indicator--09419d86-0782-437f-8dfd-7ba27a5c41c3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66860dfe-0687-4fe6-ab0b-fba9cde00546", "sighting_of_ref": "indicator--d42e6c5b-aba1-4aa7-8a67-da6a96fb669b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe7f89fc-bc8a-49ca-9715-e6267c01f0fc", "sighting_of_ref": "indicator--84eeb8d0-2edf-409a-910b-736123290a3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--107081f1-d5f8-426e-9276-cdba1bdd9e46", "sighting_of_ref": "indicator--26399472-7188-4c7b-9fd1-fdf199e2429f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82c0d54d-8507-488e-817f-113d29a6dc27", "sighting_of_ref": "indicator--31804cee-601d-46e3-ab0e-26d4af2969e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ac784b4-43ee-42e5-bb56-9113216ed8b2", "sighting_of_ref": "indicator--54394690-846a-466e-b372-6db720b3a1d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d76835e-5c54-467a-af63-543ce4bd9d87", "sighting_of_ref": "indicator--837b1200-c65b-4779-8360-1fe74375263c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--091728d3-4eb5-4d9f-b22a-9e53e5e58449", "sighting_of_ref": "indicator--f0c57a5d-5f91-42b0-b2a6-5390ffa66768", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--368ffe96-ffcc-45de-b4a3-0a2faccd439d", "sighting_of_ref": "indicator--b257ef34-8af4-4160-a2eb-795adc352daa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38b1fcd9-91d2-48e0-a4f6-8b62ffb54c64", "sighting_of_ref": "indicator--2960dbdb-58dc-4904-a399-a2ec5b193c9c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f15d825-8a56-40bf-a35f-017e1784569c", "sighting_of_ref": "indicator--6476518a-096b-47e9-bff9-dc7216783315", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a410948-08de-4ea4-9b28-18090e38f453", "sighting_of_ref": "indicator--05fa4dd2-b6e0-4ce3-842c-8462edb30245", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74694568-2be4-4f20-934e-86f7ff1b0744", "sighting_of_ref": "indicator--05fa4dd2-b6e0-4ce3-842c-8462edb30245", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092dc2be-6a51-4efc-b4ab-fda4c28ab6d4", "sighting_of_ref": "indicator--d40baa28-b4ee-4419-88ed-58d72057ed7e", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b7caa5a-b1a8-4521-ba4e-9e7cbeca2083", "sighting_of_ref": "indicator--501c201a-9706-4219-bcd6-856dcef81b86", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f0a22bd-bfd2-42e5-adf7-21ca2cbf4e43", "sighting_of_ref": "indicator--58cbc8e4-69d1-433a-b31d-a69c04560e55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf2160c-0068-4c09-ad7d-d37304bf7b0c", "sighting_of_ref": "indicator--cb381e5b-b30b-40ea-b7fe-0333837ea9ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02fde658-d2dd-48f7-ba27-375bfe5604c6", "sighting_of_ref": "indicator--9fba30aa-3451-4cb2-9edf-cfe6e84f9422", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cde33db-2d65-4b1e-aac0-f747d66fc2f3", "sighting_of_ref": "indicator--09842818-63a3-43be-906e-7d348c5edfbf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ed5a51c-5a4b-4eed-8aab-0492bbb1f1d0", "sighting_of_ref": "indicator--b220fe25-d8be-4666-a491-3e1b1a280ee4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6059f88a-896c-4263-9991-1f45b2950808", "sighting_of_ref": "indicator--92d61291-9cb3-47c1-9672-4a0818425729", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c26dc2f0-6e0a-4948-b8cb-9e22b5ff1fb6", "sighting_of_ref": "indicator--795bf072-d537-453d-9cdb-b6f264182650", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06744972-9a4c-4cb3-97a5-0d02b4a986cf", "sighting_of_ref": "indicator--51e3894f-5d71-4f0d-9bf4-06ece11baf48", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3535c05b-916d-4d59-829b-5a90d0b631c3", "sighting_of_ref": "indicator--c5c9adf6-1ca4-4361-bd34-6eabc2c15b2c", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd579076-2555-4f5a-b26b-261360ca8a4c", "sighting_of_ref": "indicator--6757e8d2-49b4-4b52-ace6-d54dcd5d960b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f618dd-ca45-43b5-8ec9-8d471d3c7a09", "sighting_of_ref": "indicator--5f6ea428-7de2-45a5-9cc4-51cd97a9b62a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f82e5762-3cb1-40f0-ad09-6a4321476b48", "sighting_of_ref": "indicator--64662553-9050-4315-ae76-acd821729106", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--717dd1c0-f34d-406c-ba77-8cb5536bc9fb", "sighting_of_ref": "indicator--a03e84c4-3bed-4bd0-851e-5ad52ffebe64", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6fd3bdd-27e6-43cb-ae97-1f529fc36c44", "sighting_of_ref": "indicator--d559948f-f835-46ba-a6d9-4b4842828d9d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172d04b0-4590-4705-a113-d4a9cfe970b8", "sighting_of_ref": "indicator--537afbda-b5e1-4254-ab25-8cfb95d16974", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46146e91-da9d-4e9d-b782-0f3a71bae70a", "sighting_of_ref": "indicator--5321429e-b715-4de9-9464-25e8fe3f0296", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f47583-a928-4f98-a3f4-e4c75b8c0e07", "sighting_of_ref": "indicator--2fd5772f-7ce2-4848-948d-ec380f507d95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ed0480-47dc-4d2e-98e7-a1466d479af6", "sighting_of_ref": "indicator--a258d79b-b7eb-4be1-b48a-36f35366a196", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d29339-ce83-4c2b-b959-89ae596b6809", "sighting_of_ref": "indicator--71468888-42b3-43b8-9615-a0b2b1cbeddb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5673ae1a-9f1f-4af7-a5e4-c9807beb126d", "sighting_of_ref": "indicator--556c4dde-9924-4d0a-aa7b-21ec475ad8c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fc20983-6b36-48fe-8ad9-682e89db4abe", "sighting_of_ref": "indicator--1e621c4d-a5fb-49ab-adf5-21a873e278e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd47d3d-9298-4219-98e3-2308812c6534", "sighting_of_ref": "indicator--1e621c4d-a5fb-49ab-adf5-21a873e278e0", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2091e4a1-acdb-4b37-a4da-8d71b70ec150", "sighting_of_ref": "indicator--ef20777b-6f43-4d3f-90ae-a32d33cc69fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde2c434-95b1-435f-ad5b-b4dd10ba79bc", "sighting_of_ref": "indicator--b41edd7b-8cff-466f-ba6a-7716f8f5c7c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5682095c-c8e5-4618-abb4-81faa9906bba", "sighting_of_ref": "indicator--a8b48be6-829f-4c1f-9ecd-6743142858f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2251838-c506-4938-92db-99d464f2098f", "sighting_of_ref": "indicator--d4d9982b-4b61-4b8d-ac40-90721b0cec9c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e60021b2-f520-4ffd-8e62-76ca763e4608", "sighting_of_ref": "indicator--cb020210-916d-4c20-93d7-383311058f8a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85619a36-7142-485c-aba1-91e717b77f93", "sighting_of_ref": "indicator--324518f7-9131-4a62-aca2-46465dd68b5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc19e4e-cc4a-4672-bd6f-e452e26cd1a4", "sighting_of_ref": "indicator--972fd86f-ae47-4ff1-bdf8-8064c52efbfa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50a4cbbc-8b48-459b-9c78-68db77a962e7", "sighting_of_ref": "indicator--3899f93a-84ce-4bc7-a42a-cf49f0d1b26a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898370d6-c5db-4323-bdf4-65eb1b161f2c", "sighting_of_ref": "indicator--72db280e-863e-47c9-8851-e4f0fe358335", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac9691b8-e1eb-4a69-b5de-09c158886977", "sighting_of_ref": "indicator--32054a66-4acb-4d24-bb99-7d0cb6100cd1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda68803-ad5f-4cce-94e2-e8ea78aa9f78", "sighting_of_ref": "indicator--993b1982-12c1-4ac2-bf26-812764e9b5b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3589c1e-8901-4f6e-a93b-28ad9d9e90bd", "sighting_of_ref": "indicator--ecc2f659-67f4-4b91-af3d-dd130ff90a5a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--237b4ba3-cb06-49ca-9fb9-ef5db1623c3b", "sighting_of_ref": "indicator--c0e74a54-4517-4ec5-9395-ef97c09f1054", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae8b5a5a-427e-4518-90be-8cce74db19f3", "sighting_of_ref": "indicator--37881cee-42b3-4142-a135-54b83e0a517b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6a01341-59a1-4292-acb2-b1c86b86039c", "sighting_of_ref": "indicator--296eaf43-8eaa-4118-a553-93cdeeaf6e2c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98a08441-69ff-426b-8285-7f3f587deaff", "sighting_of_ref": "indicator--6cb9434b-d810-451c-824b-913a7a58fc30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6bc4f87-6cba-4b22-9c3e-cf6bcb3601e0", "sighting_of_ref": "indicator--14f1742c-79e4-48da-9e1b-4d529857f320", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ac4b5d-1151-4689-be37-d46576304add", "sighting_of_ref": "indicator--856759d3-898e-44d7-8786-aef5bd0d8d7c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16793b39-7eb0-4719-bfa4-1da3346a6545", "sighting_of_ref": "indicator--b0bb18ec-c4d0-4577-9cdf-cb266e4ea2c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c705331f-3121-42a6-934d-a3076bda4e8a", "sighting_of_ref": "indicator--6cb47de1-6bbf-46ae-b974-301a197feddf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7c655d7-d758-4765-b55b-991dbca7d163", "sighting_of_ref": "indicator--ba359662-0cc4-46b6-ad45-7af437fc4275", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b8576f4-a709-48d0-8861-e4195cc58992", "sighting_of_ref": "indicator--81d3e860-6a03-4413-822c-942f207feedb", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0db438f1-7488-4ad1-bcc4-397bb9575bfc", "sighting_of_ref": "indicator--8b3e89a3-32b4-4829-b30e-c7d5762ac6ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc23562e-c95d-4796-b177-d485887518ad", "sighting_of_ref": "indicator--cf475b05-02d2-4dc2-9143-11c4f9bb33a8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37f73bca-1a72-45ef-89ea-db2782c660dd", "sighting_of_ref": "indicator--367f6bd9-1cf9-4c79-83b3-a2e95d245cae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d86cc990-9ffa-4b10-870b-e8abb4f5acc3", "sighting_of_ref": "indicator--82382f09-7a87-4514-b017-0bb73f58b3f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10653588-3320-488e-bbe6-c7b50b5a0fb6", "sighting_of_ref": "indicator--7dbfb0a0-beae-4c4d-9d56-bea0badc1958", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f78a310-0c3c-488c-988e-14bd00ab9e79", "sighting_of_ref": "indicator--84cfb210-3fac-44bd-9673-9aeb859bb053", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0e6c45-63d9-4e97-8206-ce4ce05254a2", "sighting_of_ref": "indicator--ce1e0065-00c0-4d7e-8607-d83352e98c7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a45529-fd2d-4833-ab49-6fcef07ecfc3", "sighting_of_ref": "indicator--f64018e6-d527-4f95-8a03-9e5a1aad58bf", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9025620-c202-487c-a257-b9f67f612d7e", "sighting_of_ref": "indicator--adea33de-f049-4035-9b7f-45527eaf4ec0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e840bcb6-6ad9-412e-82ef-2abae1358cf8", "sighting_of_ref": "indicator--c3eb7de4-02da-4ca3-9c2b-aac5d4bb3c9f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ad25ce-20e1-40e7-a727-bed41cb5d434", "sighting_of_ref": "indicator--d7db320c-5f14-4aeb-8dfb-011edf69faa0", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1651e5a6-68eb-4646-830e-8b671cc63107", "sighting_of_ref": "indicator--c5721d74-639b-4b76-a8f1-9ea8ec0b38a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e20b668-de6d-49cf-9ae0-0431b28d97ff", "sighting_of_ref": "indicator--a37dbade-a508-484b-9009-d0ca5245eb58", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb9355b0-4f7f-469d-9302-300dd525adda", "sighting_of_ref": "indicator--d96bb8b7-c4f0-46ac-984a-cc017e213790", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b1f21a5-4130-4712-b486-d8b42fd0e544", "sighting_of_ref": "indicator--63a375f9-ee72-4f90-8f15-b9fc61cfd248", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d83534-695a-4223-acae-bdc81e5a8fc4", "sighting_of_ref": "indicator--2bf88e10-98e7-4bcb-8b34-7ce92cea9f31", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0b944c4-57d8-49da-8d4e-5bfdd7270cd3", "sighting_of_ref": "indicator--6897eb4e-75d3-4f31-a6ba-695941674ed6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a74c9b-329b-47ad-9d76-928a40e14f05", "sighting_of_ref": "indicator--cb4eb721-b6db-4c76-bd3e-e825acff722a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--369edb9c-6974-495e-a265-5bb45bf53231", "sighting_of_ref": "indicator--8198aa2b-cbfa-410c-9dd8-f0d5e92a99c3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da8f4df2-3532-441a-af52-b8c044d0e31f", "sighting_of_ref": "indicator--f11d536b-9249-4471-ad15-1a660fb56e8f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb4a608-75a9-48b4-a545-2dc639075755", "sighting_of_ref": "indicator--560345c1-e4e5-4971-a4f8-cf4a9ced2255", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31432ec-b5c7-4acc-91cb-d78f7568f47d", "sighting_of_ref": "indicator--c584b0fd-23ec-40ca-b27c-28a224d10111", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94833f0e-03c8-4ea7-a520-e89451d20137", "sighting_of_ref": "indicator--8c4107ae-0660-4a8f-ad33-03cf7ac28f7b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f4475a-202c-4e76-abc3-5aef509018d2", "sighting_of_ref": "indicator--b641889d-e502-4132-b066-c1a3e776dca9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033117e9-3159-41be-816f-86c966ac0fb8", "sighting_of_ref": "indicator--2879ff81-1083-4d4e-904e-3d05640b4816", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89a33632-0c77-4a25-935a-fe0c0a9f4723", "sighting_of_ref": "indicator--1590b001-6721-489a-b0ce-47c6a009fb27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8f5d1f-a94b-4fe0-bdb5-d13ded84d1f0", "sighting_of_ref": "indicator--d020abe0-db00-4fba-bb2a-917d9d6c1d0b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed907de1-50a5-49df-8f6b-d38f2be608df", "sighting_of_ref": "indicator--528ab77e-4b52-489c-8413-be6cf78159e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8c01221-3b7f-45fc-a7ad-f09131088b6d", "sighting_of_ref": "indicator--6449aeca-b502-40fd-9cf5-911539223f8b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75212214-3022-484f-844a-ade9edcf0675", "sighting_of_ref": "indicator--c72d2d14-50b6-4bd0-bd54-7da6537d31a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6d2c3f-04bf-4e86-9cd2-b1d3deab84c0", "sighting_of_ref": "indicator--8274523b-b880-45ac-bc6f-ea83f4e54828", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e11a2b9-b45a-4106-be29-9710e3009a95", "sighting_of_ref": "indicator--3b51d2c1-7c56-4e58-a2c2-0f40ea775445", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d9c82cf-acd3-4c9d-978b-eae69e3a733f", "sighting_of_ref": "indicator--8389a257-bb55-4952-810c-31b4f4bea3e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3adcd29f-99ac-432f-a160-0ad642654052", "sighting_of_ref": "indicator--a1f9ed02-d4ea-4fdc-80b8-1f8251792c1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fadd3bc7-2584-49c8-967c-8e9b60886b26", "sighting_of_ref": "indicator--677cbab3-b951-49c2-9864-a4a54bcce36d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1d26dd1-4dde-44a9-a46f-67cd63edab82", "sighting_of_ref": "indicator--139e002b-7fbc-4328-892f-52922407e2dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e406278d-f230-4248-8422-044f1f4be978", "sighting_of_ref": "indicator--5975044e-dac6-4aae-9d08-7220b6639a9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798e45a0-2046-4783-8380-1cce5635366f", "sighting_of_ref": "indicator--42eef0e4-dd95-461f-b3f2-a1d9b8102fab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--618af918-c383-48e2-bb74-e5e371c86d1c", "sighting_of_ref": "indicator--6f47b80d-22e9-4044-9591-f168256d8202", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79681426-cc97-4745-9b8e-550f580ac885", "sighting_of_ref": "indicator--3aa2959a-def1-4153-8408-3e3479497840", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--402659f2-d520-4f5a-80af-1d33bc63888f", "sighting_of_ref": "indicator--a5d0cade-8aeb-458b-a767-f0f011167a1e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--194d95af-6052-4185-ad8b-7c8cd5a7b0fa", "sighting_of_ref": "indicator--a0671af4-b499-4f64-aa5d-fb651e48b539", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d53f2b9-fc93-4343-a6f6-80c1ee3b184f", "sighting_of_ref": "indicator--1ce6c480-7a0a-4518-8e34-a03120db8dbd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c6d8bbf-f8e1-410b-8b16-e447f4ee2d3d", "sighting_of_ref": "indicator--bd6e15b5-4415-44ef-883e-8eb881729856", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfda8834-85bd-463a-805b-81e884379f67", "sighting_of_ref": "indicator--8c3348a7-919f-450f-92e2-a4fe8f6ab9ad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf84631a-888f-46c8-8e7a-8f38ed7a5b69", "sighting_of_ref": "indicator--c4add938-db65-4ce0-9eca-ab95367728f7", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--797e9844-fc9a-461f-9459-a2ad09fc4271", "sighting_of_ref": "indicator--65e043d4-bbd3-41d8-87b1-f684c6d8b858", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b678e5d5-176a-4e74-8b58-8ed3ca3fbcd2", "sighting_of_ref": "indicator--7fcc4621-c32c-4824-b656-c68c26cf9c71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc84cdcc-c5b9-4ba2-a5c0-cb53706d24d3", "sighting_of_ref": "indicator--31526040-e5cc-43f2-aced-b5543f2f9ca0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de664fd0-1e25-4da6-9216-77d9ab29f4ff", "sighting_of_ref": "indicator--6f7dc53a-b96e-4481-8267-e8b6862d96c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8711574b-81cc-478c-b3af-cf486dfb6fd5", "sighting_of_ref": "indicator--75a75fd2-5dee-43e3-9294-514919599002", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0a42f51-d2e8-4692-b3b3-652b23585014", "sighting_of_ref": "indicator--893bffa9-7a46-41e1-8b20-4f57d7fa0e01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51fd019b-ca41-4e54-8eb0-e1e0e2c759dd", "sighting_of_ref": "indicator--1a7947fb-1f3c-49dc-9eea-a8a0b8c9f56c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025a3f0c-3dcf-42c5-9ad3-6ac534b7cf36", "sighting_of_ref": "indicator--bcb1edb7-c882-447b-a07a-3907c576683c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c42db7-1e11-4d22-befd-577111fc1aa9", "sighting_of_ref": "indicator--d29d385f-5ee7-4fdb-93a5-a25e1938d3a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c85e7136-4112-4305-a308-54a73f67f267", "sighting_of_ref": "indicator--caf82848-4e2e-4970-813f-e17d8663f0dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e4ea07b-ca9b-4b60-bae9-860d4413340a", "sighting_of_ref": "indicator--8c3f4705-6603-4e2f-a516-b7bdbc9d99f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4dc99f-a57d-4a26-9288-6a421f74e8f3", "sighting_of_ref": "indicator--15ca996d-ab3b-4fec-815b-6448d01f0564", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd5ffe7-4f60-44ca-8c67-d2f067ec4830", "sighting_of_ref": "indicator--5410440f-33b3-4619-8a7c-9dc6546b3075", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3989721f-b470-4740-a20f-ee899f3f9df9", "sighting_of_ref": "indicator--50aa88c0-402d-4ea2-860f-aaf2c87b1b93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1451b8d0-75fa-4d74-b808-f6be782358b8", "sighting_of_ref": "indicator--ab165e62-1ade-4bce-80cf-88e9990ce22d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e48472c1-8bf4-4690-a431-bdf62cdf00fc", "sighting_of_ref": "indicator--e1c40540-a5a8-4d86-8fb9-7159bdb5ef52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d830a067-7ecc-4b1c-b0d6-e4b7acc546b5", "sighting_of_ref": "indicator--4451cfb0-187e-4d0d-987f-fbc97d58e225", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec5366a-90dc-4fad-bc13-35f1fb6dc5ae", "sighting_of_ref": "indicator--1311e782-6545-4c06-8c38-be4c1d37887b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b51bb03d-ac77-406e-95e1-3652a835203b", "sighting_of_ref": "indicator--967adbb7-0f22-4c54-b9df-cacf77edf323", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c85edd-35a0-4936-9989-8aee1fd4b3da", "sighting_of_ref": "indicator--cff5dcbf-6fbd-4e55-8dd8-98fe213e2890", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bca9e8fa-fe24-45c9-8beb-0bea6582d253", "sighting_of_ref": "indicator--27c07a93-abbb-4cea-8f4a-1b2dff7a4069", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051ae613-4577-4c39-9941-73a1593853eb", "sighting_of_ref": "indicator--731fe8a7-9966-4a66-a6b5-8b48dfbe6351", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1422d599-592a-450b-a6bb-facc9addc76f", "sighting_of_ref": "indicator--03ef54e8-4fdc-46a9-8e8a-d27787195d09", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fb19ed1-ac05-43ca-aa7c-006409928891", "sighting_of_ref": "indicator--b90e371f-5fc6-4786-8cfe-7269366b794d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f46b2e4e-786e-40ff-9bf3-fda72f9f2bed", "sighting_of_ref": "indicator--2a841c80-d8a1-4a62-a0e1-3c1bfbfa32c2", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa3b7d9e-f0ed-4bf3-8a0d-71e1d7293639", "sighting_of_ref": "indicator--0b18b2f7-3688-4529-974b-c001fcfa4b19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--672872d2-7c7f-4e29-bf76-8b7526acc46d", "sighting_of_ref": "indicator--abacc73e-9d8f-4ee8-91d4-825a44b4e486", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a52d03b-fa92-44a6-908d-aec293c86161", "sighting_of_ref": "indicator--bd3424b6-3017-4e8d-b9f0-1f80dbcbdafd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a1b7dd1-a2bf-4df8-985d-ba60d6a85696", "sighting_of_ref": "indicator--5b33b63e-a37c-4e8c-9729-a770303e4a23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69818e4d-f85e-4377-820d-d9ab857f762f", "sighting_of_ref": "indicator--b4d897ed-5b0c-4adb-9094-cc21e56c0de0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8c61c28-ae86-45c2-8a80-47ef044442ce", "sighting_of_ref": "indicator--563448ad-81e3-4616-af9a-74317c8d3ba5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2720680-f16d-40cd-8a96-9ec597e1d3af", "sighting_of_ref": "indicator--8ad91148-3d2a-4823-8bb0-c096e871a41b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e98b60a-69aa-4744-a707-0441c0accf7b", "sighting_of_ref": "indicator--6f40c0a4-d231-423f-a396-f0ba7b5e6a15", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9937701-cdc0-4f58-9bf2-21e29dc231f9", "sighting_of_ref": "indicator--e7165104-3d14-4e55-a1b1-df8e7de48e5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9346e2ec-778a-46a4-880c-fe3c56450c95", "sighting_of_ref": "indicator--7ec5501f-fee2-41a3-a763-acdefb92f6db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ccda9e-ad30-4821-8984-61f7650929a5", "sighting_of_ref": "indicator--eb441eeb-003f-467a-9376-cc8229fb9906", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f92ea43c-8e4a-4030-bb21-bc617272df86", "sighting_of_ref": "indicator--c0c8dea9-2210-4454-80b4-d02d62075958", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6a5ecf-1938-424a-8bd0-923a9cba6c4e", "sighting_of_ref": "indicator--693114c2-0632-4267-918f-937b5d81f4a3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0577e90e-9d8a-4deb-858b-cb157bb32343", "sighting_of_ref": "indicator--a2381237-7162-4c74-89ed-a208624f2d95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a447e595-2dd0-44bc-8d21-9b2787806d80", "sighting_of_ref": "indicator--357f4e16-7014-47b0-be22-60bbcca136a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb31efb6-7829-4324-a4f1-e6775add716d", "sighting_of_ref": "indicator--c28952d3-fd64-4484-99cb-1002a621ac8d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84427457-fb0c-40f4-a2b2-f98c36752339", "sighting_of_ref": "indicator--47a2f96f-9b86-405c-8580-a6a2ddb426e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b506eadf-fc77-4080-8ec6-b20fd6058b68", "sighting_of_ref": "indicator--03c24118-7d06-4e4c-8585-0195a03b27ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9ff75d4-4bc0-4ec6-9236-9979bd87f9a5", "sighting_of_ref": "indicator--09eecac0-ee3e-49e2-ac4c-4a199ba86c97", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef9de45a-fde9-4d94-9870-8b817e9180fa", "sighting_of_ref": "indicator--0a4f134f-d373-48f2-98c2-75420fb087db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c46ecbcf-07d5-4f8a-86b3-370d433791ad", "sighting_of_ref": "indicator--b849ed1e-0ea7-4e9d-af21-ec21308b7ff9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd255b7-c0af-45bb-b9b2-f31751cd42c9", "sighting_of_ref": "indicator--1663ae96-8591-46da-af31-c0c64f719f02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d065e03-2935-4ea7-9d69-918d83705667", "sighting_of_ref": "indicator--13c047a3-d93b-4512-9b5e-c7139b9c0dda", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bcc408-3a63-4340-b3c0-1f80406b8c7b", "sighting_of_ref": "indicator--6bbc0897-a7fe-4a45-ba71-5021a17ef6fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3f5d890-cde3-4dbb-ab1c-39a0a278a495", "sighting_of_ref": "indicator--edfdf9e2-d1fe-4d66-be8a-d1fbf1a93a08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9225e1a0-5df6-4ea0-b795-5cef10329e82", "sighting_of_ref": "indicator--e9c0fa4e-84fb-42f0-bfd9-4179f1772131", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94969c0f-9e02-4b39-b6c5-61b0c437bd0c", "sighting_of_ref": "indicator--57533631-90e0-4c40-8452-f9c640f9a47c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99eff197-dd8f-4797-ae81-926f3fbece22", "sighting_of_ref": "indicator--f1cf51f7-7686-4dbd-bdbe-b92638f7ea34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb093588-f11f-4bf2-bfc1-aa9bbf37a7e1", "sighting_of_ref": "indicator--e1c8320b-8744-4912-b27d-636dc30d123d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ed7207-3e0c-4238-9a35-76cb36053282", "sighting_of_ref": "indicator--df96960f-0775-46c4-8d96-fe481e616b16", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe363f0-ffe2-41be-8544-e8d93c55cb7c", "sighting_of_ref": "indicator--827a47c2-f3bf-491c-bc96-093ad3674dff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90035ac5-8ce8-452a-9c5a-457eb68a04df", "sighting_of_ref": "indicator--44cc3c34-b787-49c8-91af-286424588b3a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db88da14-409d-440d-8c32-1293b4db3b00", "sighting_of_ref": "indicator--4ebfa038-7a1b-4de0-964f-1d72d2dd1451", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe1ae1d-ec22-4579-a82e-15ce41aaab55", "sighting_of_ref": "indicator--15996f83-f71d-4cec-88bf-cf91a56237c6", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53dc5d5b-6ad8-4878-b71b-1c5f7370aab0", "sighting_of_ref": "indicator--6131eabf-831d-4bc6-a5c5-bb9438d473e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a282aff-3de6-4c6a-b676-1158a7e9ac9b", "sighting_of_ref": "indicator--12b2e1f7-fcc1-4cf7-aba0-1b3310d27907", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7aebd7e-e8ca-4125-94a9-9589356ddc87", "sighting_of_ref": "indicator--072fefc3-163a-440f-af70-00c89c510432", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda9f435-2a15-4cbe-b667-22d48f2c4a41", "sighting_of_ref": "indicator--32c70d44-0ca3-44df-8056-61b51d6f3196", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e7f5f7e-9acd-4b58-a9cf-e0b308966a22", "sighting_of_ref": "indicator--d15eab95-3f0d-4cc4-a24f-dcbf80371f3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c10f79a-7d33-4923-a6ef-5cd1ee87ca47", "sighting_of_ref": "indicator--c91fbf8e-b9bd-4f08-abc3-0029fe06a06c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79a507aa-3560-4d03-be97-f51d393a2ff1", "sighting_of_ref": "indicator--46088cb0-f6cb-41ce-bd50-68cef48cbf5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6eb83da-4832-45d2-abcf-e60e870b3d3f", "sighting_of_ref": "indicator--61593970-0431-4a53-b30c-f32ac0d4f5b3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c542c18c-e5c0-4e7f-82c3-64f9c1c6a393", "sighting_of_ref": "indicator--e1d19496-4b20-4dd6-b41b-a806aa17bed5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--591bf6fd-ed5f-40b5-9ea7-2b6b41f34125", "sighting_of_ref": "indicator--be3724cf-fbd9-4b1f-b992-c2efb9c27ada", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1df1afe8-cb87-4886-a1b9-05f44631f953", "sighting_of_ref": "indicator--7bc3e81c-ab03-4f90-aa7f-7ee936d225a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c92b318b-352d-40d2-a314-05539d494408", "sighting_of_ref": "indicator--94403e98-4f2a-4f2a-ad24-dc2b807e6b43", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6181d81c-8919-447e-aa76-267567762acd", "sighting_of_ref": "indicator--44c23e86-71ed-4948-989d-fbbac9175b4e", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e56fe781-01ef-4904-ba71-b86d6c0eabc7", "sighting_of_ref": "indicator--10de1508-6c61-4095-836f-330df3e1a14d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9caafee-b24f-4280-8f6e-366bba7d803f", "sighting_of_ref": "indicator--71f135b8-ee01-4d6c-9031-419c2c8abf5b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e922578-9468-4b9a-9aea-5be9bb78d4d7", "sighting_of_ref": "indicator--2b0df221-21cd-45d7-9376-cd3e8f8dc752", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9621ce80-7c9b-47fd-b169-831ec77ed6f8", "sighting_of_ref": "indicator--9a73c029-a3d6-4dd3-9071-4d92c348ad37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c8e108-4735-4ed9-8928-49dfa523e906", "sighting_of_ref": "indicator--eb200950-dacc-432c-9282-be7d1ca94cfc", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69556e18-af98-431f-b1ae-20cb94c18fb1", "sighting_of_ref": "indicator--74b3d1df-e73a-422d-a955-5074f33d9607", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cf845b5-30f5-47fc-bc6d-6b7937b82f4a", "sighting_of_ref": "indicator--a7b22566-d5bd-44b8-886f-3635cafc76ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9294e4cc-206b-4f05-8eda-a22446ac861f", "sighting_of_ref": "indicator--652946c1-bd59-43a1-89b2-db3da7979cc8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7833c48-11bb-4eca-8312-4b88a33f328b", "sighting_of_ref": "indicator--f19b98f0-40a8-49bd-adf2-5cd349267942", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72c9de92-715e-4bec-849c-e96888a694d1", "sighting_of_ref": "indicator--e57848d2-448b-4973-ad1b-3148794aac35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd29033-b14b-4994-8661-a553a90074e5", "sighting_of_ref": "indicator--67752486-5460-4e07-8c5b-b73cb349634d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99ac5943-8e4f-4650-b96a-fbdfd33836b8", "sighting_of_ref": "indicator--518125e2-280b-482a-b2e8-1fc595541680", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2211e37-9b25-4877-9cf0-7c2d14f7f400", "sighting_of_ref": "indicator--d4f61f86-342b-479a-8111-f262caa791c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39908da0-509d-4dd2-a85a-70dd2a384f34", "sighting_of_ref": "indicator--f2af3076-29db-4cfa-bc60-f1d4f9ba4d39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a88da7e-86e0-4ed6-a05e-fae4d739136f", "sighting_of_ref": "indicator--f2af3076-29db-4cfa-bc60-f1d4f9ba4d39", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33b1e3cf-a271-4c25-a701-f1957f720dba", "sighting_of_ref": "indicator--32f3ccf9-99cb-4534-ae70-ddec4d6b1baf", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e447957-3b46-4cb9-ac84-2742936fcb63", "sighting_of_ref": "indicator--d5006b15-7f36-44a0-8def-2bb768060d70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34cebe2e-4b56-4455-a00b-c59223be4862", "sighting_of_ref": "indicator--23c0afa2-409e-498f-bd60-09b248ce0ddc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dee58e20-159c-44fb-b695-6e5e76f5296d", "sighting_of_ref": "indicator--d81fdce4-0243-47b2-9907-cf3606bb7b92", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5da5f32d-d595-4782-ab8b-664645385cd6", "sighting_of_ref": "indicator--112112f2-cb8c-420a-8a59-71749707ea1e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b121bb67-9d5d-48fa-8abc-b8638cab6ebc", "sighting_of_ref": "indicator--915752fc-9633-40e2-b129-c35a787d75c1", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--196f6806-a1a0-4d66-b292-f9f16314f442", "sighting_of_ref": "indicator--f97430eb-54c8-4dca-87ab-be93c69415dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e2e2e3-1294-4cee-b68f-4bcba2effef3", "sighting_of_ref": "indicator--e2a9f625-7e17-4a71-a052-0ed2c9c55733", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1173e8e-1ba4-4214-a354-09e7ed13e1b2", "sighting_of_ref": "indicator--0782124a-2fc9-4258-9950-3f020b6ba95c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--277fa000-9b73-4341-b951-4e1e4b832439", "sighting_of_ref": "indicator--0a3eb046-7dc9-45c9-bcde-d84aef697394", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--157fea88-73b7-44ce-b3fc-474f50b63fb7", "sighting_of_ref": "indicator--a41a4aaf-0bc9-4e6f-a66c-8ad857ab461d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0504f575-73d5-4e67-bdb8-a3598bf91abe", "sighting_of_ref": "indicator--334972c6-d87c-4aeb-b725-465a2455f071", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db76d754-ce6a-4697-8a52-b151fc7fb925", "sighting_of_ref": "indicator--f65fe823-adc7-44f8-aa8b-2c97abb4542f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb72d8c-418f-4bec-b5cd-148006db2279", "sighting_of_ref": "indicator--039bdb0b-0a47-497d-aec5-542a5c3a6561", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5d232b2-52ca-4e64-8d0c-1a2142417be3", "sighting_of_ref": "indicator--f8e5d5fc-ff06-40cc-b32f-427b7aba9a71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fe501d4-2747-41eb-a148-710e3a05513f", "sighting_of_ref": "indicator--02e646c6-2d3c-4931-bb92-2f7acad4c26d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8333e300-bf11-4827-881b-f1b6e296e9da", "sighting_of_ref": "indicator--92eec7b9-53cb-4a9a-acb3-4ff671f8a3f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b51dc4-26dc-4411-ab96-aeb67f1c5be1", "sighting_of_ref": "indicator--85e2eb24-592a-4a32-999c-96864d7f047b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa277e5a-15db-4b0a-b007-6cff28a2aed3", "sighting_of_ref": "indicator--c5199945-f8a4-48cc-8fa6-8f9863bdce4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2e67771-c2d3-4ef7-8540-9b4f5cdbcaff", "sighting_of_ref": "indicator--ab23aa2c-5b4e-45da-ae0f-92c878f47438", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef011859-9351-4bd3-bf0b-8ab94adc3cb9", "sighting_of_ref": "indicator--892eb961-c369-40a5-8a62-76fa586198bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b133445-d8a0-485e-9141-d1c3003ba9e7", "sighting_of_ref": "indicator--9217e9ef-9862-402d-8bf6-24693da849a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70a84dfb-fa96-427e-8628-0c8a915492c7", "sighting_of_ref": "indicator--3a2e9f41-036a-4a80-9249-02407c17b09d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc9e7ccd-5da8-4dbf-8671-a11b2766d893", "sighting_of_ref": "indicator--254785ed-b1ce-460f-b5b0-6835ffab0785", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--165e916b-27e7-438e-9e92-903f8a06b430", "sighting_of_ref": "indicator--eee53ae1-4d3b-42b5-95da-544e459346d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7344da9f-c967-4d4c-98d5-47d8278569c8", "sighting_of_ref": "indicator--e670a68c-3feb-4c1d-90f3-550cc11b0c83", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049b670b-2d5c-4668-ab88-2169bf8ce985", "sighting_of_ref": "indicator--7fed43b0-dd7d-496f-a564-47497108cbe5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eece6fe-b23e-405d-994f-3c6c54cd64c1", "sighting_of_ref": "indicator--37d8609f-f841-40a5-aaf4-fbce5eb7af02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e3282c5-800e-4e59-aa44-c0e2f299eb42", "sighting_of_ref": "indicator--961cb825-6659-49be-93df-4aebcabf7f77", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c29ccc33-44bc-4d60-a25b-7335a2a9a75e", "sighting_of_ref": "indicator--90bec8d6-ca81-4333-93ad-5a7ad8486114", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba2bfe39-7235-444f-b025-0c594142ba12", "sighting_of_ref": "indicator--d18c60da-2204-443e-8eb3-f1bbf5057593", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfe19b66-e62f-4c34-af00-8fd41d8e4184", "sighting_of_ref": "indicator--ce8a2891-0166-46c6-84b4-303794f4c3b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c844b897-5e33-4c95-8a99-75c3dd0a6238", "sighting_of_ref": "indicator--5dab3244-43d3-48d1-a421-08f00f652bda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--837a697d-bbe8-4183-9a79-06eabd4eaf60", "sighting_of_ref": "indicator--1f1ace75-1a19-47ea-89d7-c92ff7ec239a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b882edd4-93f1-4078-89d5-fce4c0428ade", "sighting_of_ref": "indicator--f7fe2749-85a8-4220-a829-a392b6e69d7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--069ef00c-38ec-49c3-8916-e04abfbe0d39", "sighting_of_ref": "indicator--0e6e1ad0-8d2e-407b-87b2-5cf22391de74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b207bf0a-16f2-493e-b20c-920d1f6392ba", "sighting_of_ref": "indicator--426a854d-c1ec-4df9-ab69-ae7c7be2d582", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bbed4aa-fee4-4c1b-ac03-92cf1dee11b8", "sighting_of_ref": "indicator--9c694d8b-71fe-4c67-be8b-1421ae1e595f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c13d08a-2bac-4718-a685-3b34ca278a8f", "sighting_of_ref": "indicator--dc1539a9-0e0b-4f57-96ab-819cbf6246f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26eb5b04-b7b7-41fd-a6ae-56d13155eaf0", "sighting_of_ref": "indicator--e9caf8a1-60c4-433e-b05c-ece47f43f7be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f32b609-f2db-4122-861b-51357f602d55", "sighting_of_ref": "indicator--e7e73636-84c5-47a1-9e6c-9dcfa51cefa0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57011199-09f3-4a9b-9aca-f92bc32b898e", "sighting_of_ref": "indicator--c672ea4a-993f-4e9a-93a2-bf66960ce4f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3634d2f3-83e4-4902-91c7-db043997a20b", "sighting_of_ref": "indicator--a7f88441-041d-4559-bfb5-cc03f47d24fe", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf5d2f1b-3c12-49e8-b8c2-37f71084eb15", "sighting_of_ref": "indicator--51c1eb75-3482-4f4b-b85a-97a38420e66c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e1b95a-ccd2-4ef0-ae08-d3b79537afc1", "sighting_of_ref": "indicator--7b2fb924-1853-4ac4-8c10-6a07055a180b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68506a3f-395c-41cf-b036-2619c05a6437", "sighting_of_ref": "indicator--69408edb-e7cc-4f2c-bf30-234e43a2ed35", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acd6fd8b-44f2-430b-9087-61399e175a35", "sighting_of_ref": "indicator--d257ab96-9565-476f-b663-07f283195147", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--890f928e-9a1a-4f2b-a095-b07c1391d119", "sighting_of_ref": "indicator--6ddc3888-ff22-4cb1-ae37-dc39b31f468d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9548b9b-47ad-43c2-92a7-ce6f4b2fdcde", "sighting_of_ref": "indicator--fe891873-c23f-434e-b520-34cbb64d4608", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea8c212-c7e0-4b3b-b01c-a5c40b8881c1", "sighting_of_ref": "indicator--50c25497-d90e-42d5-b2e1-e3692d2dea69", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcab9a27-8de2-41f0-b385-3c7d17bdc54c", "sighting_of_ref": "indicator--dee255cd-1799-4b7a-a5ea-a042326864af", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--121e1113-42a0-4b07-bd52-c3625ffb9b67", "sighting_of_ref": "indicator--096be97e-3872-49d3-947a-be8287608307", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32092e0b-4b65-4bd0-a306-b588bdb1beb3", "sighting_of_ref": "indicator--498c58f6-34ab-47dc-bcd5-4e65dba72b0b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf313a4b-a9ce-4efc-bbdc-865611d7a446", "sighting_of_ref": "indicator--941b3291-651d-48e0-9539-4362c0de239f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--002b79bb-7381-490f-935c-f4c90c850812", "sighting_of_ref": "indicator--c5d40fa3-a53a-42e3-ae50-f41859ac16fd", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1e73722-80b6-4706-8b8e-d570649b0285", "sighting_of_ref": "indicator--2ee0d61d-3b24-4138-a53d-ca86b8894a8b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d04c48-745d-4a9a-b45b-e38bc4b2933e", "sighting_of_ref": "indicator--ca294ee0-cc53-4b5c-bf21-e85a73275524", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce0f5fec-b742-4743-8a1d-0e5f3678855c", "sighting_of_ref": "indicator--1f6f2994-1308-402b-b77a-8512aaea8718", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4b2199-c7c7-4009-9174-875a6bb5b8a8", "sighting_of_ref": "indicator--ae3717f2-6587-4953-b788-07175505b0a5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30f69d5-dc2e-44bd-bda5-0a61204a3e97", "sighting_of_ref": "indicator--0d044eca-0e7f-4b3a-8578-c1b12bf7e552", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8424f15c-66f4-4a67-b6d0-0170d20120c5", "sighting_of_ref": "indicator--77e133b6-5d6c-4549-aed8-16df0f84096e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc197a15-864b-40f7-a2cd-71974a0f2dac", "sighting_of_ref": "indicator--500f2e0a-184d-4b46-9461-5f00fd16df32", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f83ecd07-72f8-43a9-9780-39761cd3226d", "sighting_of_ref": "indicator--8d20e74e-14ae-4cd5-a52f-59d12aa405c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85c1b436-bb3a-4065-8e7b-e096e57543ff", "sighting_of_ref": "indicator--08f5ddfd-8d3c-4c2a-9b72-26bf05fed3aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78f4512f-f65e-4362-a314-5c0409077105", "sighting_of_ref": "indicator--9d790469-664c-4d12-b6e5-d0206537faf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20d729dd-d78c-4872-8128-d49e005b3991", "sighting_of_ref": "indicator--6461f75f-0943-4de8-8b2a-eacc9ac0046a", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--683d3259-2a86-4d89-a0c4-53f2bbb6d1ea", "sighting_of_ref": "indicator--ac717500-9796-412c-8766-39811d8ce11a", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08e409fc-c474-42db-b3b3-875fc139fc79", "sighting_of_ref": "indicator--e267e7bf-092f-475d-9ef9-9a4cf601e657", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91525ce8-c06f-4ba5-964a-f2a74ddb8b48", "sighting_of_ref": "indicator--3274ef21-5360-4dae-abe7-72eb55cad070", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66553afa-1ab1-48c3-ae0c-8edd21688655", "sighting_of_ref": "indicator--a814a486-5b8a-4474-903b-c838ec5647bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30be8e7d-cbf8-476b-8a94-da8248b98665", "sighting_of_ref": "indicator--e771b7da-46d3-44cb-aac2-6c206b8eb809", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e7f4a12-624b-4a62-bce7-2c9b36fdb0f0", "sighting_of_ref": "indicator--ea79cd63-7e89-458e-8310-8ec543f7f988", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447af290-4fee-44a1-93dc-9a81549078c6", "sighting_of_ref": "indicator--4d5b36d8-d1c4-42ba-8ef6-8b432c2ef515", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95527f1e-04f2-44a1-8d33-ba69e7ccb0cc", "sighting_of_ref": "indicator--d231158a-34c7-4002-8223-e4d7c76c13f9", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ef243bb-65ab-42d7-b4e9-2b01c4f34a27", "sighting_of_ref": "indicator--8571af8c-48db-4df7-9d37-7e25c1a379a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d247322-f33b-4ab8-8221-6eeb65112690", "sighting_of_ref": "indicator--76441f07-5770-42c7-9858-33482a2e4e47", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae682cc-c75b-4b80-ad5a-c720e8cf8e4b", "sighting_of_ref": "indicator--51c7d0dc-c814-411e-abbe-38c7922bb657", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9957176d-8886-460e-a5bd-e68929be50a9", "sighting_of_ref": "indicator--8faca54f-2436-48e6-bc9b-2fc45095def8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90c02cbc-3fc9-48f6-95b7-e84c22638bfc", "sighting_of_ref": "indicator--c20b303c-ca63-4f61-afce-7a4b1da97c0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d2fedc-ce15-44df-aa49-1f7cae478515", "sighting_of_ref": "indicator--0f03181a-8bee-478c-9a54-bd7d65bd4f1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f41c3198-955f-4a6c-a532-4407b81f18a1", "sighting_of_ref": "indicator--25b4b6f7-8075-4be8-8de3-3254dd72e67c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a23a25-a8d2-41e8-a61f-6b0aef6fb4c0", "sighting_of_ref": "indicator--3ee9ebad-f1d2-46df-b966-bc284ef6e7f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6951ddfa-8460-4b81-adbc-2fe74e95425f", "sighting_of_ref": "indicator--49e7ea78-ffef-4d31-ac37-65f7e04edb73", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32118d12-4584-46d7-94fd-f255f28286c9", "sighting_of_ref": "indicator--ecea1247-e027-4855-b27b-d46a09aa901f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c8cdf42-c1ca-49ce-a329-96c87c85a8a9", "sighting_of_ref": "indicator--495205b2-436b-496a-9c20-7b1360ea6333", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4d32e94-d6c0-41c6-9813-1dc6fb08415b", "sighting_of_ref": "indicator--7ad17dbd-9e9e-460c-bd40-3235c01d6e61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b74b95d3-4806-47b2-867b-a26c7534671e", "sighting_of_ref": "indicator--788df880-18ed-4722-b536-a6aaf36938c5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d03ef4d-6945-47d1-8528-f0775b8c06f9", "sighting_of_ref": "indicator--e8e788c6-53c7-4b67-893e-1a211c6b86c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd99ffdb-09ee-44f4-8a5e-6d8a69bbde03", "sighting_of_ref": "indicator--03187eda-fdb1-4f07-ab67-03dbfb2eec20", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6b28be-ff01-4593-8b36-e5a738ec2a95", "sighting_of_ref": "indicator--8d14f962-e2c9-48b1-8559-0d3b6abadb69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ec975b-4801-4df5-88be-a00276346275", "sighting_of_ref": "indicator--6d5f7563-5fe6-4da2-9ff2-82fa4990f641", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af87914-9606-4acf-bc2b-f3df793d065e", "sighting_of_ref": "indicator--773dfc08-2f69-4cca-9d09-39b3892175af", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5553ffa8-7289-4557-b49a-2517e4436b19", "sighting_of_ref": "indicator--85fcd237-0ff1-460a-a694-da435fa770cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4356aa2b-0e82-45a1-8611-0139b1a3a642", "sighting_of_ref": "indicator--2be9d02f-9f12-4a8b-92ad-661900a526a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a71f2ff4-03be-40ca-b16c-f1695fbae3cd", "sighting_of_ref": "indicator--79e160f2-d425-47e5-a5d6-ada370224e12", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a772cb4c-96cc-4586-9069-39afacd6bd0b", "sighting_of_ref": "indicator--22d988b2-320a-40bc-889f-62ee9dc02a8a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3f2ea1-e1a5-4f57-ab7d-076ab49bda07", "sighting_of_ref": "indicator--56045ab6-4e08-496b-9a66-a2a3b927b238", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08b1f4c8-e900-48ba-82c5-7c3fc1e671a6", "sighting_of_ref": "indicator--f28769e0-5b3f-45dc-950a-c52e0b0d6fb2", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6877f1b-a338-47ab-940c-81568b7942dd", "sighting_of_ref": "indicator--44f0cbc8-e818-45e0-a55c-02faad8298f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f0763da-07bd-496f-ab03-0f4d0fbd9976", "sighting_of_ref": "indicator--ed881b22-7762-42e9-aca0-2cd5afd0221b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--950c417b-00aa-42e3-93bd-1ff9149dadaa", "sighting_of_ref": "indicator--bfbd5895-cb85-4fa3-ad35-bd08263e0dee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe9d3f86-2326-42a9-a4d2-69989e7942da", "sighting_of_ref": "indicator--140ee905-a376-4919-9b1d-e6834269d7df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11dbb42e-51c9-4ff3-9827-599be06cd6e5", "sighting_of_ref": "indicator--b169df60-06f1-4ef9-8c0b-0909cda9120d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d8280bd-5d88-4a32-8c73-70cd230998da", "sighting_of_ref": "indicator--d9055f15-5f77-41ca-b08a-f9965f35061c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49aafc19-8875-497d-8a13-10edee6ed19b", "sighting_of_ref": "indicator--1ec0427f-99ce-41d2-a1e0-61bd97385b48", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2cfdc2-8446-4f57-af3b-abee0ee7c5fb", "sighting_of_ref": "indicator--5292fa89-bfa6-4104-916c-096f8f095c02", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29621ead-64d8-4392-a59a-79afb408b0ec", "sighting_of_ref": "indicator--8a6ff649-b624-4745-a436-a14f25156597", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a157ab9-1fde-47c6-9d65-0bdd5da33a98", "sighting_of_ref": "indicator--c9df0830-ff05-4d92-b1ed-8e8ede632c9e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a925843a-802d-4486-9137-3039054e2dd4", "sighting_of_ref": "indicator--94f60d48-13fc-47c8-b32b-a120e48c3dda", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--381e5dd9-15f1-4539-b484-e8abdd3e7aaa", "sighting_of_ref": "indicator--20fd52d3-7de3-43ba-96f6-ad916585a017", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90daeb6-81ec-4cf4-b262-e511c906b110", "sighting_of_ref": "indicator--98a3e80a-7bc1-400b-8382-9bc884961fc6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd326de-7789-4c99-ab9a-5c1f7f182a92", "sighting_of_ref": "indicator--98c7dd05-0105-462e-8282-4f5a73dc576c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f0ea222-e1ce-4e95-b77d-ae19cccb63b1", "sighting_of_ref": "indicator--f3c5a430-7adf-4061-ae6b-0f4a9d88647c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b224992-abc1-4d5a-a624-68b51d4b0da6", "sighting_of_ref": "indicator--bce3ce99-baa3-4d40-bd23-b5dd1684586d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4809f9ae-d253-4143-b0e6-66b976c0a79a", "sighting_of_ref": "indicator--460b8a63-5fda-4c1c-9226-dac6be5dda7d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d38cd6a-51d7-4a0a-95f3-33c9104b81d7", "sighting_of_ref": "indicator--e19ae18d-0da2-47e0-9f9c-6a32483328bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80212932-3924-4d35-b61e-9a6b8523451f", "sighting_of_ref": "indicator--de9a2493-dc76-4cc4-a63b-1183a5fc2250", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97f4a043-29e6-4e4d-a253-a582d364eb39", "sighting_of_ref": "indicator--a79207d1-fc02-4506-83d3-eaa944a65ee3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee90e9de-5344-4d51-8a1f-7fa281b73d4a", "sighting_of_ref": "indicator--23a0831e-8a7e-4bab-8df1-f024a3494f61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac42f300-fcc4-4a96-8e50-419599d6f92e", "sighting_of_ref": "indicator--2a6f2c5d-66cb-435e-a1a2-cb75d19b17fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44c920e9-0789-4433-b71e-da98b22348cc", "sighting_of_ref": "indicator--1e496ba0-30e5-4e1b-a347-de3b9df775d5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bcefa92-4dcd-4a8d-9b85-0d4521f6731f", "sighting_of_ref": "indicator--ff48bfec-f15d-4f6c-9756-f57cd6c14e5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d86249d9-2bfb-47c3-9b94-0450ed66d32e", "sighting_of_ref": "indicator--584ed8fa-e5cc-49c2-b401-053b71ec2851", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb4e7e4a-b790-4241-9404-48ac70f884d8", "sighting_of_ref": "indicator--95f0c681-09f9-42ff-a228-2e8ad6737267", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a55af2-ea23-4f92-959f-82c4ef8682b5", "sighting_of_ref": "indicator--066b7dc2-dc4e-4c90-8572-90ba9bd09e6a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab68716-76fa-4235-b49a-9a10acbf252e", "sighting_of_ref": "indicator--852bcc6c-d7ef-4996-b1aa-f70dbee5cf56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1220dfb-3ec2-44eb-8280-fafd3bf532e2", "sighting_of_ref": "indicator--e9391331-7aaa-4d39-822c-9457ed5c175c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f238ce6d-66b5-450a-85f9-969d2f85ffba", "sighting_of_ref": "indicator--aa1bd28c-6425-40f5-96e3-7581f696c447", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f46c8fe3-d4af-4c3c-af62-f0ded36bbee2", "sighting_of_ref": "indicator--56a91ef9-94ed-46a3-8607-ca18795bd098", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b3a69e6-14fd-4ca0-bc4a-3d4c0ca3195d", "sighting_of_ref": "indicator--d85c879f-0791-4d4e-a4ee-6900df17c754", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd6ce3e7-e729-4aa2-b990-97d23975b77f", "sighting_of_ref": "indicator--dfe80f85-715c-4e8d-83c4-f5c767b0192f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674d275d-a43f-4202-b231-0b8998c5371e", "sighting_of_ref": "indicator--3ae3e97c-a6cf-460f-b4e5-67d72a2a806e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a819409-6a0e-4420-9a98-94c5200537bf", "sighting_of_ref": "indicator--9cd17589-41c7-42f8-9b80-1ecb06464cb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd172dbf-a72e-4928-855d-7260e77bedd1", "sighting_of_ref": "indicator--0bc38997-be1a-44fc-9354-a263da909379", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01c8841-d1da-4fb5-a12c-2fafe2b9e6fb", "sighting_of_ref": "indicator--ce2bf9e5-9fc9-4ca3-bd9b-8e75bfc93d46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c2128c-d457-4def-9149-44c5fb3358a6", "sighting_of_ref": "indicator--4da24ec0-6c0e-477b-b22f-4ba140b30fb5", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d2be1d-1986-4c1c-8a4b-35e0193b6980", "sighting_of_ref": "indicator--efe47620-c17d-4382-9c17-27116c138d55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c048418-0847-4946-b577-0e26e01650be", "sighting_of_ref": "indicator--788300ff-ad18-4a3a-b9b5-8354c24c406b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67275a45-d50d-4ce5-b9a7-63dd3e8f5c62", "sighting_of_ref": "indicator--f808eb7c-50e1-4580-8ed1-70306054c449", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7b0acd0-8c11-4be2-b5f7-76a823b5b3f8", "sighting_of_ref": "indicator--134a2147-c058-44ae-903c-a9ca4f962829", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe465709-7d03-4d65-9a21-8dc9b6a26808", "sighting_of_ref": "indicator--0f49dc54-dc38-44ca-8ad7-186b38b150ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfa77e12-dd4b-4ac0-b3c1-991b26b1dc57", "sighting_of_ref": "indicator--49d5569c-6862-4c1c-966e-c8b23178bcd5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dfa0e9c-14e1-439f-a42e-88c4f1a45339", "sighting_of_ref": "indicator--5cae5b92-0e88-4553-8cf6-75caa60eda33", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42574357-a84c-476f-ae11-1a55bc1d7e10", "sighting_of_ref": "indicator--a306627b-1837-4cf2-8610-41a9ad3c225a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a07abc9-8843-4a93-a190-43192316fc66", "sighting_of_ref": "indicator--1532f88f-20df-45d4-aeb7-2c91ab25236b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9fefb0f-d872-4d72-bace-3435d248fc7e", "sighting_of_ref": "indicator--9a99a28d-87d0-4fcf-84f4-b8d6fe3724b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81e0bf3c-f983-4519-b8b3-2b923180b746", "sighting_of_ref": "indicator--940c8a2f-0a58-46b2-a7c6-859330913103", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1312aa6-a180-4fc5-9a37-83d55f07d625", "sighting_of_ref": "indicator--997adc74-9725-4bb0-9625-f1421e176d45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c481f942-3005-44e2-a826-9bbe7f486dcb", "sighting_of_ref": "indicator--2a352167-22ba-4328-92ca-b9846d46a444", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d9fcb3-db7f-43aa-9bfc-46227bf795d2", "sighting_of_ref": "indicator--eb4eb7fa-2212-4f73-8b02-4f3dca891cb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b033760-a770-41ac-9257-9fe507985a91", "sighting_of_ref": "indicator--6f7d3ce7-05fa-4bb6-a007-8c3634703601", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cab99325-6429-44b1-9539-bf3b7f00c35b", "sighting_of_ref": "indicator--30b0949d-9218-44cd-bddc-eede27fbb89c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60feb4a-d294-436f-8920-52ee12480416", "sighting_of_ref": "indicator--3e67b56f-2de2-409d-a70b-bb4dd1ca78b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e506cd5e-7db7-4593-88e9-85db63a39ca8", "sighting_of_ref": "indicator--9efaf122-d706-4fd5-a31e-8ca066c01157", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4606f75b-27d9-4f53-ac14-19ce9937b7e2", "sighting_of_ref": "indicator--ac748164-92e6-41da-86a2-357e0e45492a", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f68c370-0288-4306-a568-bba5e58ac89a", "sighting_of_ref": "indicator--1f3acbfa-5e0a-42b4-a091-9cb3de6b7905", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5109a8b2-5040-464c-961d-64769d23a0c9", "sighting_of_ref": "indicator--52e76d67-ff8c-4219-ac75-e9c209264db7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2206465a-3533-489d-9bd5-fb30ee707c47", "sighting_of_ref": "indicator--46652e93-5fc2-4539-a36a-91f0fe9b287c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1db51482-a524-4f65-bc62-db49b054b5e2", "sighting_of_ref": "indicator--2c59180f-c58a-41f1-bd67-6462478e24c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c12070e8-c57e-40d4-a07c-02ea16fb0ba2", "sighting_of_ref": "indicator--f0f52451-3c9c-45f3-a4a0-20b5d5448811", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cd229c7-c7f0-400d-8aba-6b35b552c5a7", "sighting_of_ref": "indicator--180aad2b-eec1-4521-8507-65684b9b521e", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28de719c-f933-4a17-b641-ded5b013d6d8", "sighting_of_ref": "indicator--c4ee9fd3-ca95-42a7-8f60-da366f34ce56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39792d0b-e00b-46fd-8a55-db21fcda8447", "sighting_of_ref": "indicator--68099f92-3948-4fd2-a802-446ce51d528f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f6e224d-15b6-4f4f-b4ee-bbb034329599", "sighting_of_ref": "indicator--fe45e8dc-b998-4364-a0f6-a49ffd4ac487", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59061567-7d12-4334-a9b7-a78317671b73", "sighting_of_ref": "indicator--bd437207-36ad-4c06-9e6a-49f73a47875a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2ddc4b-b106-4104-89c3-6a3ed1c4d379", "sighting_of_ref": "indicator--773d5242-3785-41ef-9530-ede5290e1956", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac7da7ca-49ce-4787-a93a-e840f286ed70", "sighting_of_ref": "indicator--cae2418d-1bdc-4585-b4fe-70d9a40c1e41", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0281012d-3eef-4781-bc7f-446028435e3b", "sighting_of_ref": "indicator--e9e6aece-5059-4ab0-8f43-d1667a2307b8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ae8d29b-01cc-4bd5-9145-961ebedd306e", "sighting_of_ref": "indicator--adeb3fbe-25bf-41d9-82ac-dbc83fe910dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bad8c996-d955-457b-8167-3047e7534f67", "sighting_of_ref": "indicator--e1475c1c-5e1a-4564-87d9-d883769bf134", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cac0cc8e-2885-4e35-8dba-d8d3197fbcad", "sighting_of_ref": "indicator--dd6c5905-2585-4b42-9e21-50681d51f14d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--742bc96e-afdc-4ab9-9e6e-82370dbf16be", "sighting_of_ref": "indicator--ac52cd5b-0058-4034-9378-fb2e3b983d9a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b65abce3-e8dd-4da6-917d-e23c3ba38f0e", "sighting_of_ref": "indicator--fa538a4a-8591-4ffe-9963-741e49593030", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf1bc54-7bc4-4f6e-bfb6-c87c43c64425", "sighting_of_ref": "indicator--f55fb1af-b688-4c44-a52d-d0accadbef86", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12288c74-f977-42da-9248-d16a117c0213", "sighting_of_ref": "indicator--b0c2c758-197a-4892-b543-6f2ba0f14ac2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eee21737-5851-4b6e-b1a1-42f826d1ac1a", "sighting_of_ref": "indicator--748efbd6-8bf9-48a8-b4f6-99b2c58be933", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f50a1a-c0b3-427c-aa09-fcbcae6f6980", "sighting_of_ref": "indicator--14eb4c4e-994b-480f-9891-43df67bff87c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c735988-b36a-4af3-92f6-1e7cabbb510c", "sighting_of_ref": "indicator--fb8a1772-5a12-4cc4-8c62-4815f7f9a8c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f7d5d8-bd9d-42d0-a133-2f774bc93436", "sighting_of_ref": "indicator--a5ab7a44-8bf7-4173-8d63-a1d1d7f62085", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3748199-7e56-4e38-8b5b-b2b7d60c0b66", "sighting_of_ref": "indicator--7986828a-6d50-489d-9afc-2ba99c768a1a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a71b9d60-d7fc-4a99-b00d-f6faa405cc4e", "sighting_of_ref": "indicator--a1e99faa-6690-4c0b-8daa-fb09765cae54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc2987f9-2ae8-498a-92b1-ecb9e91bff0e", "sighting_of_ref": "indicator--e99e5543-71d8-40a4-a899-d6dfaf6a2958", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d6d05c-0773-45e1-b37f-74da829a8c67", "sighting_of_ref": "indicator--ba78fad7-93b3-4949-8a99-7727a9d6f898", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cf6d233-ea84-432d-86f9-bf4886ebdb87", "sighting_of_ref": "indicator--edc8fe72-323e-445f-b879-09cc930f6a98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2ca1b1f-2580-40f6-80e5-035a91224fa9", "sighting_of_ref": "indicator--eb4b855f-f9cb-4132-8fa5-5fc45e0ea21c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a37f2873-fea8-49cf-b356-a45ab6d92a4a", "sighting_of_ref": "indicator--f5c8ff7b-4064-4c8d-b986-5f948f2fb83f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c8dc3f-01a1-4d2d-8e8a-344fbdf470aa", "sighting_of_ref": "indicator--0d442b47-21d9-45d1-8f90-80f866e50a4d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d090c3c-4aa2-4a93-8ec6-7172f09d55c5", "sighting_of_ref": "indicator--97660732-00e0-4191-ac44-38fea731843f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a83cf30-242a-4d33-85d5-9030e64cd851", "sighting_of_ref": "indicator--46ff31cd-fb15-4bf9-be13-e8bdc1ca1b80", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde7e742-8ebb-4b1e-b47e-9dee9ebd6b38", "sighting_of_ref": "indicator--cc58c069-c209-4e9c-be30-9ad6d6908682", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03bd2b71-c173-440f-b408-c966cc0b4f52", "sighting_of_ref": "indicator--6000f8a5-be55-451e-a05e-74e24b076b32", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ffee6cf-43a7-4b18-8a5a-79c9e722c4ea", "sighting_of_ref": "indicator--6d0cde15-7ea6-4862-b0cc-faaac2142020", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cbfe734-7d9a-4822-8f67-ab52a512acfd", "sighting_of_ref": "indicator--2eb8905a-1975-4488-9e4f-284ccc038e5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b37898a3-280c-4cae-a809-2e1108d8584b", "sighting_of_ref": "indicator--e07ffde1-208e-4c9b-ba42-9ac4827c8859", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcaf5e5a-ffdb-4968-87a7-f3969486c54b", "sighting_of_ref": "indicator--6fb1ad01-708c-45f7-945d-7d827fc25c10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f0159e-ca64-49a9-90aa-cae4c7df56d4", "sighting_of_ref": "indicator--db4a2f3a-501b-4b3c-a4a6-29fc0d9ad756", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77fc4f56-ae87-474f-9e4f-298f8d073b96", "sighting_of_ref": "indicator--495c0965-5222-4690-a019-da148a4d9dc4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cd19320-c3b2-4108-8146-fadb52df7916", "sighting_of_ref": "indicator--561bc1d3-2387-4be6-964d-e59839fc06b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08af881d-661e-4be3-bc52-bf868abeddf1", "sighting_of_ref": "indicator--e97bb8d8-7a96-4356-918f-46fd10327d61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6efd4d9a-052a-449e-b44b-2bbc9df1efc4", "sighting_of_ref": "indicator--53547ded-87d2-4fdf-9802-db8ea3a39382", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--378ed8f4-f977-4892-984a-d91b2b4a8645", "sighting_of_ref": "indicator--e04667ff-862c-4776-9954-9871fbed3d11", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87efef19-0122-4e56-a310-8871f8f9ecf6", "sighting_of_ref": "indicator--c1912cc0-2949-4130-a033-9f187469de58", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cb42590-6191-4d17-8d82-3c7a1d4e2292", "sighting_of_ref": "indicator--73147c44-0726-48e2-9289-dcc091e993f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1c0eab-c263-4db9-be35-8cefaa4f724a", "sighting_of_ref": "indicator--a0880ca0-5a2d-4e49-acad-762ca50c2d0a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea9c0052-13cc-4e5a-bef7-6716191a2258", "sighting_of_ref": "indicator--de7d524d-091e-452c-9379-6ad2bce97e65", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed5d50c-4d6f-4ea8-9252-31a003b11b01", "sighting_of_ref": "indicator--8604a814-a3b4-47b4-bfdc-c082012035d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--874c91ed-1190-4fd9-8015-df556436527e", "sighting_of_ref": "indicator--92be606b-ddb3-406c-8326-db5acb4474a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4efdbf8-db63-41ab-9653-d9f07ea0ea4d", "sighting_of_ref": "indicator--b73ed89b-9524-4bfe-8990-aab6581860bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0638df6f-76f4-4997-b8d7-01bb6cb73198", "sighting_of_ref": "indicator--c4773eac-c362-48f5-b26d-63865a25b7b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4b1efd-cc51-448f-a309-c824e6474058", "sighting_of_ref": "indicator--6dcabef2-e58f-4d77-8b0d-a393ceab39ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfc40b8e-f53d-48c1-8f2a-2e609dd814ed", "sighting_of_ref": "indicator--6e54cdae-5730-486c-8473-5866d253e780", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3d1583-b935-4151-a8bf-2decd05257ec", "sighting_of_ref": "indicator--6e54cdae-5730-486c-8473-5866d253e780", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8c95292-41c8-4871-a165-b068a126a197", "sighting_of_ref": "indicator--7332e792-d720-43f9-a96f-6667e7ede4c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12325560-bc66-4924-beae-d77ae32cfec1", "sighting_of_ref": "indicator--24da6851-81bb-444f-b32e-1577c8ecee0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f60c686-c8f5-47bd-ac76-c75aed9f28ea", "sighting_of_ref": "indicator--7fb14aad-6af3-4efb-86f9-359be41072ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78d71e7a-1701-4a55-9942-17ae07b42489", "sighting_of_ref": "indicator--47fa39c6-1a44-48f7-b331-7151a07d43e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78c28eaa-596a-4fa0-b60e-1a950e347308", "sighting_of_ref": "indicator--19f57326-dea7-4343-b85f-e7e00e97722d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ff788fd-86d1-4b5a-991f-248b87c62b0e", "sighting_of_ref": "indicator--f2adc9a8-ba00-485a-8479-6de6acbde891", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93629dd2-dd73-454c-b5f8-28f010e05089", "sighting_of_ref": "indicator--57fba122-562a-4504-8cc4-c09d1ebc1a27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3dee422-4686-4750-aef4-fc761c358b15", "sighting_of_ref": "indicator--b6e6b6b4-6906-4f4f-8b23-c4b2c564d1e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf7ffe8-8b75-4590-a747-c474ebb39105", "sighting_of_ref": "indicator--0bce147b-6c2f-469a-b12b-1a1804b75958", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dd83e9c-1630-4f5a-87ee-abd0f70d685e", "sighting_of_ref": "indicator--212b3076-3c36-4af5-8f32-ca7ff21fa013", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--872a2926-ecdb-4631-b30a-06959cdfcb9c", "sighting_of_ref": "indicator--9ca97e08-56dd-4840-ab7d-cfb3b8c39e81", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a083712c-b547-4317-b07b-b51162605e5e", "sighting_of_ref": "indicator--95c161e3-6265-494b-9c3b-02f891ac5a30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7b8bdd7-8b51-4931-b4bf-394e790242d4", "sighting_of_ref": "indicator--ec0c8c05-ae6c-4184-9935-aa2c364bc69f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c978cb-5959-4e22-8e09-d1b956f5ba13", "sighting_of_ref": "indicator--327b968c-8d17-4e3a-893c-a1350fb89e92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53b0411-f886-41cd-a960-4ea000a66421", "sighting_of_ref": "indicator--338f38be-700f-45f0-a788-689f0d1b484b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1260dc0-4308-4565-bbef-28527c093f46", "sighting_of_ref": "indicator--6a880b68-afca-4102-a300-837b0ab00b61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34118ced-842d-4761-be85-e133f926f358", "sighting_of_ref": "indicator--5dccfd49-b784-42ab-960f-4d03bd361ad6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bae5b38-9ffe-4f2a-9ed9-8ea8cd333005", "sighting_of_ref": "indicator--a5060a72-0cec-4349-8192-9e901aba164d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5c57712-da0b-4d3d-8d12-dcff8fcc0cdd", "sighting_of_ref": "indicator--a0c5afed-570c-48eb-a5dc-3bd20c722bce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7dba0b-b3c6-4ea0-845e-5b96194771f1", "sighting_of_ref": "indicator--458c3e82-1f09-43b5-a53b-5542e22105b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3be52ed-23ca-4ebd-bbc5-65c7902e4261", "sighting_of_ref": "indicator--15dbcecb-af36-4938-91d3-d27406759654", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e7fdba-c4f6-4ff6-9bf3-8deb541c1080", "sighting_of_ref": "indicator--a41aa8b1-4c7d-4d31-af04-479c4d3d1fc6", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c642049-3814-4391-8018-e014693eed07", "sighting_of_ref": "indicator--a5509d28-6134-47ab-b8cc-a036e033eb84", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f05ab09e-fc85-4069-a664-5fb8b85254d8", "sighting_of_ref": "indicator--394cba6e-50e0-4527-96e8-9ff07f143efd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59d844eb-82ba-4d67-beac-e01579bd4289", "sighting_of_ref": "indicator--1637dab2-bf12-472e-ade9-23bdb53db416", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a912d3e-c3f8-4bd8-a9b9-a03bb4f17267", "sighting_of_ref": "indicator--e10987fc-bf1d-4170-8dc1-579c9a9abdf1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66459448-089f-4a95-819a-46498be8e5af", "sighting_of_ref": "indicator--31a2376d-534a-4beb-b9b0-77f636abf80a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6860bcf5-d008-429c-981f-4612d217309a", "sighting_of_ref": "indicator--dcd1f47e-1226-478a-87bd-3e093ce10f46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24bce169-ed54-4bbe-a169-f8d75707e091", "sighting_of_ref": "indicator--6647a312-24c0-4a74-bfea-655c48c30299", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035a1627-ea40-4b67-bdc8-52072f020a48", "sighting_of_ref": "indicator--46685a3c-d72b-496e-a064-7ef98aaff78b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81976fdc-48fb-4604-a801-ea7508cb7e7d", "sighting_of_ref": "indicator--556856ed-e36d-4c73-9fcd-00e3cf8b547a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4246e30a-5e93-4e8f-9426-89ff69d77ae1", "sighting_of_ref": "indicator--ff4c80cc-5541-409f-95d8-b629dee9904d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b20368e2-b18e-46ea-a013-7c43d9b7d6e5", "sighting_of_ref": "indicator--d5a7735a-3953-4890-9ff2-e610c2c0adf5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb43b0f-dd27-4de7-a1ce-6ceac811d685", "sighting_of_ref": "indicator--674dbcb5-a5eb-4aa4-9853-a30fcd42304e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--905d2c96-be85-4a92-90a3-7ee91f91b30c", "sighting_of_ref": "indicator--a7185701-667f-4191-8b92-04b129954761", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae0426c-cab0-4819-a654-bfd898a144a8", "sighting_of_ref": "indicator--c76fc0da-0a57-4cde-ace2-a159625abeac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--985531f6-ea6a-4ef0-8b87-6d6b1ad3b948", "sighting_of_ref": "indicator--f151123d-c238-4ce1-88cb-e21b6d9070b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f0d84b7-1785-4c04-9488-b60faf51fac7", "sighting_of_ref": "indicator--d57eca28-3945-41fc-99a9-f744bc1b02f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe18e89-f85e-4004-8d37-31fef69b19dc", "sighting_of_ref": "indicator--d0dca87d-54fe-428c-9633-a8dad86f4663", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f29bf5f-171d-4cd2-b0e8-161c72626408", "sighting_of_ref": "indicator--d1d999c9-a437-42ca-a55d-493ed12222a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eafb22fd-55e3-4490-a2b1-93d417a03ea2", "sighting_of_ref": "indicator--57c515a6-a3c1-4d53-9e41-040dbefc99fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fc02432-6e83-4ba6-aed3-e4ee4b3bff62", "sighting_of_ref": "indicator--aee6cdf8-396c-4728-afe7-f89af5a1c59a", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de01532d-aa35-43ad-8686-8591f9ec8c55", "sighting_of_ref": "indicator--eb3f8fa8-52b0-4aea-9d82-3815280b4787", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81b482ba-a0bc-4c56-8115-b6688f80d1de", "sighting_of_ref": "indicator--173c7521-7679-4bfc-a9b7-0f3e17afcfbf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d8e40c-d25e-4e6f-9349-7e7c39b3f387", "sighting_of_ref": "indicator--7b0fd0a3-4960-42c1-8f8c-93cb1bab37f5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a38e3a40-87b9-4983-9baf-fe4e036e9c52", "sighting_of_ref": "indicator--1e6e6b40-7458-41f7-a71b-da16b5837e75", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e1b72a9-1f06-4b8a-a76d-b34138eb210e", "sighting_of_ref": "indicator--de825265-3bcc-45e5-9abf-c5e4fa5952d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3e4d34-1f44-4eb9-a5f0-db80d65b70ce", "sighting_of_ref": "indicator--0c53adc3-68a4-41d8-8f83-e5a5f5cdcb23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f7aa0b5-688f-4df5-8f1b-3f701705fded", "sighting_of_ref": "indicator--7955d7c0-a992-489f-9c22-24f164058bc9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00b86272-e52e-4c5a-8e33-0a58a5a0aa0d", "sighting_of_ref": "indicator--de33d330-b39e-4d74-8654-3025acc5d3fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc8e9c8d-e3de-4a51-a587-beeb37853c48", "sighting_of_ref": "indicator--e9b3691c-b1aa-44fd-ab24-3c9b5452bc62", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd7087c-65c4-4aab-b5a6-2c3754c9d205", "sighting_of_ref": "indicator--e6e57cc0-b947-465c-a159-aac89fe73e5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e99b108-3cb0-4cbd-a6e0-52fa84b4474f", "sighting_of_ref": "indicator--c3ef804a-472c-40ad-bcc5-376564c816a0", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2597689d-7056-4f8f-9296-2b84637e578e", "sighting_of_ref": "indicator--ab01c26b-5c44-4ad4-ad17-72beb38d9414", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--818c9748-bd8b-483f-abde-f2231e564e59", "sighting_of_ref": "indicator--4811fff3-37c2-45e4-9153-a8790b651ebb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae4fa3d-efa0-4503-bc9f-c01018cb0e32", "sighting_of_ref": "indicator--5183015e-cda9-4983-8aca-6128d26003f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4b5dd75-a650-43e3-8928-22add21d6159", "sighting_of_ref": "indicator--943fa0cf-738f-4308-be85-863e8a604928", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5023629-54c1-41c9-a99c-623087d94eff", "sighting_of_ref": "indicator--fbb108bf-ef57-4b97-91b7-77b5fb05cb2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8dfc2c1-b90e-4644-af6f-900aefb5f6c3", "sighting_of_ref": "indicator--71cc4fd7-b027-45a3-8d10-4d3944d3f400", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4dda8f8-56ed-4a29-b59b-b10bd4542863", "sighting_of_ref": "indicator--14c77e35-a529-48a0-8834-96b67fe801be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--746e0479-1815-43c7-b71c-3ac421b38d71", "sighting_of_ref": "indicator--6b301a39-e15e-4245-91ad-048f4d86fa09", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee119482-00b0-47c3-bf68-1314a244be00", "sighting_of_ref": "indicator--524b5778-b3d4-4953-91ab-cb1a65285595", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2a10367-0573-413a-91d4-8d2df35cc59e", "sighting_of_ref": "indicator--e7dd1bf1-2e37-4eeb-8c4c-fe7a1a98af5a", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f6b7e92-fd1c-47e4-9d74-047d0280af11", "sighting_of_ref": "indicator--bacbc8e4-4ddf-4b11-a743-da31c0c48114", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a688bc-800b-4087-a948-a46d56800665", "sighting_of_ref": "indicator--d3f32a54-40ad-4fab-9600-6772bb3361d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a95008a-25f1-43bb-b86f-30ec0f179ce9", "sighting_of_ref": "indicator--7733efbc-d8a7-425e-bce0-bcd5449da64d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78b2f4d8-f125-44ae-a103-38da10aaf94c", "sighting_of_ref": "indicator--48b3454c-0689-4a40-b0dc-2a47478bcbc1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e76ca17-411c-4861-b1a8-71ac9740b8fc", "sighting_of_ref": "indicator--cb343cb9-8987-443e-be04-18b9423d047d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bbb78aa-498d-44c0-bcb7-2c65cccefa15", "sighting_of_ref": "indicator--a23ca60e-b853-4a57-ac65-7bf93e82e836", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2074ceee-a6e4-46b5-8a04-b7300dc50c10", "sighting_of_ref": "indicator--3aed9e98-59e7-40c8-aed2-ee60040dcd50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1835db8-5dde-4e32-a3eb-896b5456d3eb", "sighting_of_ref": "indicator--216f9efd-cc64-4c39-a56e-b00a5a6cf655", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a2dfa42-4a43-4341-84d7-38d4f8982ed8", "sighting_of_ref": "indicator--39b0b667-5049-423c-bfaf-0f32a1dad5cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6cca316-fa01-445a-958c-53b19064000c", "sighting_of_ref": "indicator--f060933a-e8fd-4492-83c9-6376d1d55699", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e0e4001-d0e6-4a02-b260-af02a232074a", "sighting_of_ref": "indicator--edc017ce-98b7-4842-8779-c0fe443ee181", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667da0ae-7cf6-4abf-b90b-aef4d9009095", "sighting_of_ref": "indicator--cfbbc460-9afd-44ba-961e-3a36fc7d736a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e3437a-3e0f-4798-9e33-595fe09060ea", "sighting_of_ref": "indicator--d3fe5feb-8fc2-4e3a-9627-3982554cfd7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd78e88-e61b-4550-b294-07d4c07aa85a", "sighting_of_ref": "indicator--5efdc668-2e75-41e1-b112-fb1188e6591c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e41e7bab-afa7-4033-9f3a-df592ab0fe36", "sighting_of_ref": "indicator--39b3ba32-a27d-422e-9ca3-c186d7200cde", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57cdac2a-f2aa-4983-86dc-34cbfa301906", "sighting_of_ref": "indicator--637fe239-14a3-4e7d-837f-422a867a5dde", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2fb028-06b7-4950-bccf-a1de4c9ae193", "sighting_of_ref": "indicator--c7da3831-a877-4951-838b-01c1fec3f3e5", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f85f6c3-b94d-4839-8af2-3244fc21fa58", "sighting_of_ref": "indicator--ac56b2a6-d77b-45e2-a409-dae95987373b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1192f3-feed-4350-ae16-3df23a529760", "sighting_of_ref": "indicator--772ea6e6-7b96-468e-8488-5b159dd37748", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b5c5af-9b08-4c2e-8960-0e6042baaf8c", "sighting_of_ref": "indicator--b1e6e12a-cc7f-4562-85b2-16dd889144fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d65af583-9473-47f8-8c74-f8c21ec63a7a", "sighting_of_ref": "indicator--76c374f3-35e5-421c-bb53-9fb5f12cd756", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbaf66a8-15cd-41cb-a550-05d83020a0de", "sighting_of_ref": "indicator--ca9c99f0-4db6-4427-bd4e-22fc115e0264", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e4d784-b77f-4cd5-8164-71dedfc6e194", "sighting_of_ref": "indicator--53199e38-666b-4a97-8436-752f1eb6f0c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f105ee63-f8ed-40e9-af09-04ec0a02ae10", "sighting_of_ref": "indicator--5664271f-4ea9-4070-b9c1-cabc0edfae53", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e20f9efc-e415-49bb-a592-834b57e0218d", "sighting_of_ref": "indicator--29ba099b-bcce-4a98-a2fe-b28f20d31062", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a37232e8-befc-4901-a8e7-cf71c018ac05", "sighting_of_ref": "indicator--7633eece-7b95-46ac-9d77-7207ad4e4c62", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6b246b-57a6-435d-b573-c7f869bfb969", "sighting_of_ref": "indicator--f1498a7f-0c7c-4b9d-878e-58fe13dff8ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c32032d8-9a86-4cc1-acb0-d4d839dc7b9c", "sighting_of_ref": "indicator--e45d4646-e241-4387-a535-214c88bf48d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e49146-255c-47b9-aa47-b22e9e5ad5f8", "sighting_of_ref": "indicator--918ee58d-4fe3-45d8-aa4b-1fe6a6ddbee6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c38fb2-2264-44f7-adff-7c95ebbbdf7e", "sighting_of_ref": "indicator--501b4d78-2478-4755-946a-bd3f902d1ecc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f00b6f49-cb0b-4eaf-be12-a419db99adce", "sighting_of_ref": "indicator--eafecb84-c889-4a18-b3d5-68fb0fa7531d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee595e77-b1b0-4b5b-b4fe-8d474719a12a", "sighting_of_ref": "indicator--6cd25279-8ec0-46a9-ab33-b1e79f8e9776", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55bfcd4e-a00f-4456-b30f-9956fef4d071", "sighting_of_ref": "indicator--32fc95fd-f43d-4486-8e56-d9cf2aa6aa94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ece9deb9-a9d8-45bf-9b71-57f9ef4dcf54", "sighting_of_ref": "indicator--10f74112-22ea-4bde-8cd5-7c8b9af996a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6afcefd6-cb44-42d9-908d-644e3fcdd9c0", "sighting_of_ref": "indicator--f488a517-f923-42e0-a75d-59445fb8748e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--461c2367-b794-4618-9741-b73b655e1d98", "sighting_of_ref": "indicator--c00b0dfb-f110-4eb4-9f61-50e0db7dcbc0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4bd3bee-1e82-4763-b2dc-f732c71db06e", "sighting_of_ref": "indicator--de42912b-42b2-4efe-91e7-090ff5bb0324", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--004da7ac-08a2-43a9-8574-9987ee8739f2", "sighting_of_ref": "indicator--3dcff657-c01f-4831-a2b7-f1e488f3e924", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4baa8eaf-3624-49aa-9254-0126a2c106ea", "sighting_of_ref": "indicator--0c1d7ef0-ffa6-4642-9726-ce53dbcbd697", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--663c967f-64cc-4565-9707-7317abfcd8ff", "sighting_of_ref": "indicator--9627d49b-b7d7-4831-a8d0-c19b22797dcd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1f7bb8b-c556-4866-bcf8-4a6fe075b567", "sighting_of_ref": "indicator--1d365253-de40-4818-b8a0-a0f19e867f4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02446a6c-6b71-464b-aaef-ee0d16fbdbc1", "sighting_of_ref": "indicator--92ae73d6-38b2-4f0f-8b43-10bf84110bcb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e472a407-e437-4bf1-a9a4-abe57de9d543", "sighting_of_ref": "indicator--35519b57-f15f-479b-a830-6343a7ac72cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e322b081-d59f-4fdb-8ea9-8625f61b02e3", "sighting_of_ref": "indicator--db8f0738-dd66-47bb-9a05-f79cd187c455", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e44603-acf8-4829-998d-ff0048a7792d", "sighting_of_ref": "indicator--40a61a43-f349-48ae-8695-90511ebbdc5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ef56fb-1529-43cf-9747-b41b17027fb0", "sighting_of_ref": "indicator--0f0eae4e-f0c0-42bd-b46a-9187a56060f8", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2fa9b94-313b-4cf3-8659-3bf86124044c", "sighting_of_ref": "indicator--dd9961e5-b8d3-40f5-8fc0-c1771a527293", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--571556da-c682-4dc2-aa77-21ffa957fc34", "sighting_of_ref": "indicator--843cde55-a40e-432c-a695-8c171940e1dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--886bc498-600a-47fd-acfb-d0f3567ff137", "sighting_of_ref": "indicator--bff79293-e0ae-4f99-aa80-8692485e6480", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c130fca-9900-4275-90bf-3c0398e9732c", "sighting_of_ref": "indicator--bda593f5-3148-4436-98f4-8e051239d9d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6bf60be-4a45-49ab-b9b6-520c98dc3a97", "sighting_of_ref": "indicator--4e7cb482-91ae-45c0-b5a7-7f951e32286b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a0e0cfd-4f3f-41f9-aa66-4873e7d42147", "sighting_of_ref": "indicator--029d5a14-6723-4478-a0c2-e59139924bba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0cb0d32-e8e6-4592-8b5d-2524899d1a71", "sighting_of_ref": "indicator--e4b94798-5be6-4cda-a233-035ec5ac44f5", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7118dd86-e0d9-478e-95ce-9e310e2a1659", "sighting_of_ref": "indicator--b603ca8e-6c7a-4b83-bc30-402b7e70c08f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc9ec21-71fb-4df9-ab0e-8063242f254b", "sighting_of_ref": "indicator--b603ca8e-6c7a-4b83-bc30-402b7e70c08f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02fc61d5-98e4-4882-944f-b863aefc9abd", "sighting_of_ref": "indicator--c1631742-b9fb-46e7-9966-3e002c0500bf", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cce99b2-9b08-46c4-bd82-d59ae6c474b7", "sighting_of_ref": "indicator--0bf3beb8-8272-47bb-b9a2-b3fb89f4a29d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd3c34b-c993-4920-93ef-c6b9f70379bb", "sighting_of_ref": "indicator--1cbfc5ab-e531-45ce-8d2f-44b075217b76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34c81d1d-d548-4006-92db-61529743c23f", "sighting_of_ref": "indicator--ea654cfc-ea70-4fe3-9c86-23fa73d9a6ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25698d28-707e-42f1-95ac-a5fe985f381a", "sighting_of_ref": "indicator--4d0245d7-20f9-407d-9e64-243b85775746", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c1932c1-018b-45a8-9b8f-7e193cd54d04", "sighting_of_ref": "indicator--85d49b3a-413f-4d22-bbf6-9f1ddfaaf6ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7afba58e-c60c-4945-85a8-c359bc9703a5", "sighting_of_ref": "indicator--93c63fbe-665e-4d2f-bc91-f3928edf4252", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2023f0a9-2d2c-4187-84da-059b7c16ef23", "sighting_of_ref": "indicator--33e25831-2063-4990-aa74-45024c94fa4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cef0e17-e0a1-467b-ab99-1d0acb61f6d8", "sighting_of_ref": "indicator--06de6ef3-7de6-4240-b808-70c3557c2108", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--969c8a21-763e-4951-aee3-7122dcfb8bd0", "sighting_of_ref": "indicator--6bf15b76-21a4-4c66-9f87-c0cc57083c91", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--508d389d-c837-4977-a724-619dfa2de40a", "sighting_of_ref": "indicator--03be7c3d-b5d9-45b9-a65f-df7bbe4dcf6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd02476f-4afb-43f1-9eac-7011214b4726", "sighting_of_ref": "indicator--83c9816d-3e6b-4e8c-b8bb-78c3b7c204a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d3ee4e-795c-40a5-89de-f2028e8640d1", "sighting_of_ref": "indicator--127c72b4-039f-4e14-b475-6ce225b9f53a", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd82cae5-ff3a-4579-acc5-3013ba8f9d6f", "sighting_of_ref": "indicator--dc98f6f8-60ee-4a86-9573-fd8930d7c40e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5a0055f-4349-44f8-8184-35fb7ead7854", "sighting_of_ref": "indicator--ad2385d3-8815-4fcf-b390-f999b17d7a35", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--818ce9f2-942b-4f43-8a3c-76e42883f226", "sighting_of_ref": "indicator--697e8157-87d1-465c-9bb0-18a09cfb6357", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d06f17-fe6b-48c8-9875-37f67a3e0943", "sighting_of_ref": "indicator--60b85bc2-71ef-464f-a7f7-e32a7b28d685", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c52034b-7d81-4e42-9be2-e1e9d652564c", "sighting_of_ref": "indicator--85d765a3-89ec-4ace-bc6b-1b25126c6060", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8e3cd7-9df5-442f-830f-9b628a169488", "sighting_of_ref": "indicator--ea7c82f3-0125-47c3-a229-ebd6593cef4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506f0465-4708-447c-aae2-fd8fcf0ba7fd", "sighting_of_ref": "indicator--6e64e413-021c-4173-988f-83afe97c8d3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ef7194-5455-45c9-b8d9-a4951a2eac45", "sighting_of_ref": "indicator--bd1ed626-56c5-4f4d-b919-ba3719b810de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dca36b8-bb3c-4c70-bd92-1fdfa4126bf6", "sighting_of_ref": "indicator--8c06b327-d672-4422-98b1-6678e381c7e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6a23034-04bc-46c7-86d1-26d3e546e8b9", "sighting_of_ref": "indicator--2ab019ff-2ecb-4e6e-8ed6-5ec6479c443c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452f40b3-94f6-4864-b865-31225d44176b", "sighting_of_ref": "indicator--20b52a30-d778-4534-a387-f12b4d66dd60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c4424e-56d7-4817-9abf-5d989193223f", "sighting_of_ref": "indicator--6cd93b30-4fd1-45e0-b866-1c912a1ae210", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692cafb2-db36-434e-9c2c-7cb0d9264939", "sighting_of_ref": "indicator--ed14d5d0-0397-43f1-8142-1d57cf4e467a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af303d6-870e-45e5-b9fc-3bb9bab0e15a", "sighting_of_ref": "indicator--51b3bb05-c0f8-41b1-be5a-e43dc7958836", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9db05867-1eaa-46bd-9894-dcc2366845f9", "sighting_of_ref": "indicator--362485aa-211c-4060-bec9-a20b89976e7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65960288-e840-4344-bcee-b8fa8f191ead", "sighting_of_ref": "indicator--446a0c1e-f2e6-4208-9f4f-3b9865527770", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2733a559-c62c-40e1-98d1-92e61d5e2b6b", "sighting_of_ref": "indicator--7dd0c7fa-31a9-4b29-ba6f-51618d72302f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0b6f75-ea83-4009-b5a0-013e13c3db0b", "sighting_of_ref": "indicator--b7ad8621-a157-492e-b789-e5045e7014ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bcdfb82-782d-4437-838a-d182d070d3e2", "sighting_of_ref": "indicator--33f0e3fd-2d8c-4d64-9658-7b35861212bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37bbca04-b125-4be0-b009-2e51e23f77ab", "sighting_of_ref": "indicator--6b68f853-f527-4985-84ee-a69dd27c8108", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b026ef2c-e227-4f45-8f2e-2ae63780dd22", "sighting_of_ref": "indicator--379b14be-f6f7-45fb-81d5-9ef214dbb573", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59fb957-5000-41b9-9fbf-b572e188aa0e", "sighting_of_ref": "indicator--5acec222-c0b7-4f32-9430-2c1a7adfcec3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f3d0e5-b46e-4079-b228-00a3bde75d1e", "sighting_of_ref": "indicator--2103ec17-aca6-489a-9ac0-51c44bd4f136", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88083fd7-3c3c-43aa-b7f4-4fa61d398b7a", "sighting_of_ref": "indicator--d4f56768-7515-4092-b26a-24c8860116bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7037bdb4-9001-4c66-8e76-199ac1089001", "sighting_of_ref": "indicator--80a91d81-f3c7-4cfa-adc8-920796cd30f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f1a674-50b3-4ddc-b00d-4e1852640d0c", "sighting_of_ref": "indicator--a59e9dbe-7a93-4c22-9a47-6983bfdbd579", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d42f7af2-afd9-4598-a295-0fa94fa10d7a", "sighting_of_ref": "indicator--04db5bbe-3919-4177-b96e-53cd7ded1b94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a85f23-f4c0-4fca-bd6a-e90c64299290", "sighting_of_ref": "indicator--3f82a80a-24aa-4edf-908f-804af89fa8d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c1739c2-d0cf-438d-8e0f-2af648ed4a55", "sighting_of_ref": "indicator--209021df-df6c-446a-9f4d-44273cb3bc34", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8d144ad-cb9a-485b-8257-ed1ff5109a2d", "sighting_of_ref": "indicator--b1de97ef-0b9c-4796-a32e-78dc2f5d0ea0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de0cade-adcc-4cb1-8dd5-7aa6eb8f9cc8", "sighting_of_ref": "indicator--92c8302e-6950-408d-a648-c8986c1dc21e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c3bba8f-1b47-4767-bc83-e9cbdfc9b225", "sighting_of_ref": "indicator--d7c8d8e9-1119-4393-b7a2-a1c533c4383a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b5013e-7a4c-4aad-9da7-e1c0e718021a", "sighting_of_ref": "indicator--4b921d01-cbb7-4c97-b46b-d8b8566b7c4b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36569a5a-10fa-4866-a9bf-443b9fb9e0e1", "sighting_of_ref": "indicator--06e91349-79dd-4fe8-abde-e6bd6800ca5c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1774abe-be9c-408e-934f-26977d0ccdbe", "sighting_of_ref": "indicator--394ad1a2-bccf-47db-8c49-c928a9d26ccc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa41e6c8-7b45-4ad7-87ac-935a130539c9", "sighting_of_ref": "indicator--9c7ae9a8-96e0-47b1-a99e-6655dafecdce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7812cd7-8f06-4ac7-9861-4477f9d3114b", "sighting_of_ref": "indicator--b7a4096a-f3c3-46e5-8160-bf341aaf2df8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9880e437-5125-4a8a-9182-5508164f3c10", "sighting_of_ref": "indicator--0a88dc77-3d57-4a32-a466-053a0c6c82ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed02d3a2-7403-4aa4-825e-bb422f48b507", "sighting_of_ref": "indicator--2ace8756-4255-475a-a819-5db9fa961102", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14f2ba9-96c6-41d6-8e2d-183484d1ff49", "sighting_of_ref": "indicator--07da6a2d-d676-435f-a649-bd51f63f6918", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33026429-241f-4896-adde-ef7db4131260", "sighting_of_ref": "indicator--d8a7f6e4-52a0-4f31-9f5d-d74e057186b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4805d66-b806-4805-a45e-59a8002c1245", "sighting_of_ref": "indicator--e112fa82-b634-431d-86fb-eebaa134a43f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c325cbc-7b47-4cc5-a0ba-fd7e2b51e49c", "sighting_of_ref": "indicator--cf810779-7cb5-4b76-8a1b-ef271240f386", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877c977b-b515-4482-a6fe-b905e5a070b5", "sighting_of_ref": "indicator--f268f239-94c2-4329-b984-63748911a958", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e22647c1-d0f1-4c93-b35e-65558907e956", "sighting_of_ref": "indicator--ba43b19e-6ec1-4660-836e-7c49737f81f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e09b636-186c-4764-ab9c-890305faf2d1", "sighting_of_ref": "indicator--81208802-ed18-4bb5-b27a-e70cfdb7bdc5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97048ba4-9c32-4a33-bb4d-a4080a693db8", "sighting_of_ref": "indicator--81208802-ed18-4bb5-b27a-e70cfdb7bdc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b368c9e-3e1d-439a-a424-2e370919db65", "sighting_of_ref": "indicator--fae839f2-0f8a-449b-b0e4-f70c9b64c64a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5bc393-babd-405d-ba98-8953e5b84738", "sighting_of_ref": "indicator--72771632-cc68-4379-b70d-fff1b8440d56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34474e5e-76bf-4079-869a-8aee063b5834", "sighting_of_ref": "indicator--973be874-0456-473f-8499-022c0ad4138b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--795408ad-7d49-454d-b1bc-76013d4931f9", "sighting_of_ref": "indicator--065c84fb-f7b1-43ff-b9e5-4a74171e49f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef6aeea9-8593-40e9-8673-f08500f289cf", "sighting_of_ref": "indicator--a7f9f2c6-9222-44aa-b6b0-833c6caa730a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e6f9a60-f0d2-467d-9450-3515e1233af9", "sighting_of_ref": "indicator--ca07826c-f980-4152-89a8-626b26ca1d1c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--346f8db3-6d3e-4b29-99b7-4643f5aaebb3", "sighting_of_ref": "indicator--71ac39a3-ede5-470e-9f6a-cd9ff636b754", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--071eba6e-9161-45d1-933b-d26f1f3f81ee", "sighting_of_ref": "indicator--ad9d4d07-1d67-47cd-9678-f349e2269d22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d8b42b0-3234-4186-aab2-49bc7d527230", "sighting_of_ref": "indicator--a72784ea-5229-4c85-8ba1-cde359f1286c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f9a7da1-5d0a-44e9-b003-ee9e0ce14932", "sighting_of_ref": "indicator--1793e93d-234d-41a4-8fd3-3240351d669a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911e1397-7a56-422b-a36a-baa283cd2979", "sighting_of_ref": "indicator--1163613d-2bdc-455e-a069-3e3fa224df98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb5857f8-8704-4744-90b3-fca9f1a9fe6c", "sighting_of_ref": "indicator--a584369d-c3de-4aee-a8f5-ce020c627458", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06562875-e978-448d-9030-6bdfa4f0ba24", "sighting_of_ref": "indicator--004807ff-5727-4ceb-a831-402dfd8fb308", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77d4ceae-d9f8-4849-9988-5120fcb5640f", "sighting_of_ref": "indicator--17a73141-bba6-45fd-bfe9-53d5366077e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa934a3-b66f-4616-9f2f-ed3717f27641", "sighting_of_ref": "indicator--77a537ff-a8fd-4d1b-bff7-bd51ff04e94f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67992cd6-5a03-4f20-b1c7-4454d5b3cab2", "sighting_of_ref": "indicator--68ff1569-6811-487e-adf9-c45b107e1be4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01586f15-c9ea-42fb-a575-f1e53ce39c8e", "sighting_of_ref": "indicator--3fa587db-82a2-4e79-bdef-f102edcb0139", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35242ed-59ce-4b9c-95ae-ee1531eb5d5d", "sighting_of_ref": "indicator--dd69d03c-7221-4dd3-bcec-47dfff0bec49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa25da65-7211-4448-9eae-6e7fe3b90ff4", "sighting_of_ref": "indicator--4352d5ff-13fd-42c2-932a-d625cb135b17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9130796b-1d97-4ed6-8ada-3a61bd00cbc4", "sighting_of_ref": "indicator--c4f0fddf-9eba-4a96-94fc-88bed7c99b5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60626533-51f1-4943-b5fc-54503a42e9fb", "sighting_of_ref": "indicator--8470e178-8049-4fa6-8fb5-fcabbb49b5c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e1aa86-9fb2-4f01-9e55-fb8d76c50263", "sighting_of_ref": "indicator--97098bac-f852-45b3-a9e0-9a1a0643fdb1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b11903-1f28-40fa-8144-87f46b808bd6", "sighting_of_ref": "indicator--97098bac-f852-45b3-a9e0-9a1a0643fdb1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--029677ba-beb1-4843-8ef7-e367d12b18d3", "sighting_of_ref": "indicator--09f03aee-03da-4284-843c-5659130dd2ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--247ca0bb-c545-431b-8e30-2be9eaab5911", "sighting_of_ref": "indicator--784e3f74-c241-461c-82e6-b58d88fbdc78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae35981c-1b27-40fe-aea1-31171f695266", "sighting_of_ref": "indicator--182d32d6-a054-40e8-a528-0a66a896fa39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a12a8a07-6810-4f98-ae0e-5854952a19dd", "sighting_of_ref": "indicator--9ecab157-8eca-42ed-adc4-35b388eabbef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9dc95d1-6179-4194-b38c-23852b4f71ea", "sighting_of_ref": "indicator--b077f1c3-10fa-46fc-90a3-a8afd2f93c4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c0950b-e877-4cc3-8a3a-ebb224f12b55", "sighting_of_ref": "indicator--94c54c79-a34f-4d3f-b704-e13966dfea88", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7faa23b1-31da-4bd3-8cc0-9a58376866c0", "sighting_of_ref": "indicator--af55485f-0c04-411a-980f-dbdd0217d125", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4132dc5-3867-4bc8-9426-a82d3362537d", "sighting_of_ref": "indicator--7824ff8b-a17a-4be6-84c3-2229c9ccc730", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6decbf35-90bb-4b82-bfff-9f690ec45db8", "sighting_of_ref": "indicator--ee82847b-73a2-4895-b99f-f509fa32eca1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92200c16-0655-409e-9645-36e80493e52c", "sighting_of_ref": "indicator--56691b96-0f99-4002-8657-61f70b7aaf61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb418e2-2302-4c03-aaad-a31644c9dc44", "sighting_of_ref": "indicator--da657285-f47a-4589-b96f-0d38224601b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e1689e5-253f-43ec-93e2-b89778b1364f", "sighting_of_ref": "indicator--42546a9f-413b-4495-aad5-14f8e039be43", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb419cbb-dcda-457a-870d-2164200cf66d", "sighting_of_ref": "indicator--e9849bf1-07ac-4309-b55b-d53014afc9c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fb46632-be23-4892-863c-b5907a354042", "sighting_of_ref": "indicator--7b9f3240-2a63-4b5d-a79b-26ef19f1601d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8458ee79-d87b-4e1f-b8a0-bc94ca3d99ce", "sighting_of_ref": "indicator--a3f32b0c-e144-4ffe-aeb5-1ff5aef0a518", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cee6117-ee33-4234-be41-d1ecfcabbebb", "sighting_of_ref": "indicator--457fc0c4-95a3-43c3-ad9f-071db9e54d2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab40947a-7cb3-41cc-990b-0a287ef89fe5", "sighting_of_ref": "indicator--d6a06e3d-b726-442e-a54b-9149a254bc54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bae3c4e-09bc-4da4-8e09-042c9dba2b43", "sighting_of_ref": "indicator--5691e136-d0e4-47a6-80f6-3f2876d1f588", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dceef058-6668-4f5c-8709-ead1bf979646", "sighting_of_ref": "indicator--c74df22c-4198-40cf-8fae-c5eddd8c7a2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27315064-4d84-46ac-b1e2-33b7f05c9c93", "sighting_of_ref": "indicator--a94c89aa-5502-4c79-85e2-16f9c32dfcba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--685bd5da-3a7d-4dfb-a403-434edec5d31d", "sighting_of_ref": "indicator--a94c89aa-5502-4c79-85e2-16f9c32dfcba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6ea13c-fc80-4d86-b513-76cc0942fbf1", "sighting_of_ref": "indicator--d4a67c48-4a85-4b42-8e44-d01586f40dd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--892b1091-a522-45de-a5d1-586cf68bab0c", "sighting_of_ref": "indicator--9848fbaa-dd72-4052-8d53-bff068d26129", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0f709a-d91a-4c0d-acd6-ec9c4c4a116c", "sighting_of_ref": "indicator--c91b3b43-c683-4df6-ae78-fd4b986468cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0daf94-5306-4a97-a9dc-8d1ee3a0a9b2", "sighting_of_ref": "indicator--b883ef4d-54f8-406d-a62d-32549acfaf98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3addd7af-aeba-428d-9085-83386a7b148a", "sighting_of_ref": "indicator--130b49d0-b708-4c40-9eb1-66a96ebbd444", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1869a83-9e16-4ecf-9fab-1d44ff09a8f0", "sighting_of_ref": "indicator--6a39c0be-7daf-4839-9cf8-b13134770028", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6135e6d1-169a-44bd-a397-2edce93ee3be", "sighting_of_ref": "indicator--fd5ab9a6-5ace-49ec-b636-bdc823e49764", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc75b7f-c042-4480-b82c-25010a80395d", "sighting_of_ref": "indicator--dc7a5188-2943-4bbe-8b60-cc32d481f37f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf9cdae-ea83-4422-adfe-a41440ab3f0a", "sighting_of_ref": "indicator--2315f181-bbd6-490b-a2af-ae17dde21470", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccefcff6-a3a0-4395-8503-23b2f7174523", "sighting_of_ref": "indicator--25d44371-de1e-448c-a607-17d532882128", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53646dbb-dda6-4c06-ab06-58d9596c3a08", "sighting_of_ref": "indicator--8ffc89ce-ce78-4afb-b9dc-03338e270897", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e7b8d85-9be8-4954-b5e6-ecf946e3027b", "sighting_of_ref": "indicator--4321de85-cf01-4bbe-80b2-ecb8c217dcd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56e611d0-72bf-4696-a5fa-e02ad3f7e368", "sighting_of_ref": "indicator--fa75abab-b9b2-45a8-82f9-97244c2f8a5d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a69f74e4-0798-4ee1-b247-f99e09bb56a0", "sighting_of_ref": "indicator--6729bdff-947a-405f-8a48-ca216109690d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f42620c-148f-44f4-9866-a2c10a45b162", "sighting_of_ref": "indicator--f3aa1db3-454f-4e2f-a4f2-05b0b8adb2c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1dd434f-e7cb-4a39-9880-5f75dde10389", "sighting_of_ref": "indicator--826e0f7a-b843-4de5-986b-41ec62e51652", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--952cd577-9c90-4e0a-9545-fb53d1695c30", "sighting_of_ref": "indicator--3265097a-f012-4667-bd27-08db1fbfe65e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c4864f0-f7d1-47ee-88fd-afe9708b05f6", "sighting_of_ref": "indicator--8d31761a-9744-4c23-a12f-65f127a79461", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f4f2b55-9ec9-4777-b974-cff0f8ea0828", "sighting_of_ref": "indicator--120e1547-351b-4960-8bd1-77f227aa09f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a4b48cc-1f24-4bc3-93dd-aa1489ad18cc", "sighting_of_ref": "indicator--dadfd928-6278-41c6-adc2-c53cd16384ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68b033c4-cf7c-4260-845a-780763ddf20e", "sighting_of_ref": "indicator--45f46361-30ac-4bd9-927c-d8c3958cdb73", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ec9e81-66b6-41ed-9cf9-ba7f2eed8de1", "sighting_of_ref": "indicator--d131e0aa-b1b5-4bb8-8f6f-e46b6725ce56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f0c5a35-cabc-4109-8607-efd3d0c24f7b", "sighting_of_ref": "indicator--df15d089-f990-4b67-a08e-0140589e24e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2250e8ea-f1b8-455d-8709-c08bf671b490", "sighting_of_ref": "indicator--224ce1ec-4bb0-4524-b3b4-4949b3713923", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ddc2b61-eac7-494f-98ec-92f01a1aa54f", "sighting_of_ref": "indicator--78e6cf2e-c308-4180-a148-bead5b64e0f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fc7403-7138-4079-8e4c-f94a54f2cdb9", "sighting_of_ref": "indicator--eecf3f61-86cb-4740-856f-11839c31b397", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8573f132-98e7-4058-97f7-6b1ab068367c", "sighting_of_ref": "indicator--6b71755d-b637-4d92-981e-f9d19e58ed8c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbee52b-eee6-4166-bc7d-47a82bb93a41", "sighting_of_ref": "indicator--b9b8e7f5-b4fd-492c-ba92-8f12b6c124e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2238384-3dd4-44a1-af46-6d1973b637ea", "sighting_of_ref": "indicator--c4e790d6-eefe-4c6d-95c0-6dad714048c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c425f1c-c7b2-422b-b413-6d61f8893130", "sighting_of_ref": "indicator--13b17a28-2fdc-4370-9e87-4ff693d3dc32", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9a6f8e5-9bdb-491d-9a10-3b9f3538541a", "sighting_of_ref": "indicator--dc697617-23c7-4198-b66b-487ea4d39d92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e87b434-283f-4f42-b82b-12253828c624", "sighting_of_ref": "indicator--a9dffc55-8392-42a0-b36e-35aed3f416b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--115a91f9-0079-4d92-86b9-3020d0b8d18a", "sighting_of_ref": "indicator--01fe252a-6aea-4ccb-ae3f-89882bab1aa7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4166630b-64aa-442d-9bec-eee00ec711ba", "sighting_of_ref": "indicator--e3461f90-6fea-4f97-ae31-a9f80ef57ec8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6659942a-74d8-46f2-8af7-219ac2d3d077", "sighting_of_ref": "indicator--840f6e5e-7b3c-41a0-923e-d3f4d5ed83ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d41414eb-dd95-47f7-9aec-a15ea9d7758d", "sighting_of_ref": "indicator--992d42d2-664e-4ce5-a2af-607613392ae4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0666f65-d419-4953-b13d-47f034265f3f", "sighting_of_ref": "indicator--49ea6f97-ac81-4e91-86ca-f37c58bc0da2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667f5f41-1ac1-4fd7-9ddc-85dbb3be227b", "sighting_of_ref": "indicator--1f83dd5f-7eff-478f-a58a-4229c039d11b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94fedd1b-c099-42cc-bb5e-c5e0eb470d65", "sighting_of_ref": "indicator--29155b3c-bc95-4284-87f7-3bb06e06c212", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f35e38-854a-469b-a5a8-2c120ce21902", "sighting_of_ref": "indicator--ef662a6d-8655-4267-9de9-58694f3fba29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5be50314-288b-4e64-ac15-3685bdb10733", "sighting_of_ref": "indicator--206eec04-27f7-462c-8ede-0927037b5459", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--550e2a37-1eca-4c31-b5b0-31514fbdb198", "sighting_of_ref": "indicator--ff3c899c-cae4-4b9f-beb1-09c7552a3eec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c438e58-7f84-4f69-9693-239c0fca8178", "sighting_of_ref": "indicator--56e2951a-5793-4ec1-86cb-36d7d035520b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--012892c6-8e58-4c2c-b1ab-9f0dfc57ac18", "sighting_of_ref": "indicator--4ad4b75c-a1fd-4b67-b78f-a04440431b7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d2def60-e8b6-4b5f-9bc8-f66dc1f579d9", "sighting_of_ref": "indicator--6b505591-1e0b-4ba4-bee3-a0089deed010", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0979a11-0052-4266-9a1d-9d087043d026", "sighting_of_ref": "indicator--a4700f39-f9a8-4ff5-a792-a946c0c28712", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5ebc8c-5d09-41d9-b71a-e8d34498b830", "sighting_of_ref": "indicator--98225589-b508-4e33-addb-13e2b6cb172b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169a3355-831d-495c-9809-e3584aed6772", "sighting_of_ref": "indicator--7db30180-0b0d-475b-9c14-0f42697deef7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d1ee51-1c10-460c-91ff-0c10050c0f45", "sighting_of_ref": "indicator--92e977df-bc62-47a9-b75b-ca53fcda6a01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919494ea-5ffa-4ce2-bc77-f26fbcbb1fe0", "sighting_of_ref": "indicator--db8a3c2e-ff4f-41d2-a30c-85c7f0adc2bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81be2aa0-01f1-4be2-b591-b0ae01ed446f", "sighting_of_ref": "indicator--dbc644c3-526f-46eb-bd07-6fcd6911e193", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3b58dee-a44c-4591-83e2-2c1ac7c1c1f5", "sighting_of_ref": "indicator--7bdbdcad-9455-438f-bd7f-c887ee043861", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0e01a2f-efad-4760-a0a1-d92789f342e1", "sighting_of_ref": "indicator--91e6c037-1f90-4e9b-9468-213e24c7f9c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50e9c1c8-89a0-4b33-b685-25c153bfbf8e", "sighting_of_ref": "indicator--58796cb6-fbc6-457c-ba0f-79dd45c509ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ba75c7-f609-4f7a-a81f-4869ff1f8b76", "sighting_of_ref": "indicator--f22dc6bb-e70c-4aef-ab53-9e85aebf70fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b28b08d4-96fc-471f-a0e0-f6f7a52cbd20", "sighting_of_ref": "indicator--76370797-a59d-40a9-87c8-53d6cb518226", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5336a09e-3330-4cf0-84a7-6824347761f4", "sighting_of_ref": "indicator--86b44e11-795c-4b5b-ae90-56d1b48e5e35", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3918b8c5-bab0-4286-a9c6-ce862ce161fc", "sighting_of_ref": "indicator--eebe465d-1442-4e50-8f2e-cfc5dac344fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6552f16a-6c0a-4e98-945e-1dc4511af37a", "sighting_of_ref": "indicator--732535b6-9709-4a01-87fa-fc0376aaf9e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ec1d483-7515-43b8-a810-c7e788273fb4", "sighting_of_ref": "indicator--701bb6ad-53c1-4adf-9c24-b0e1d7a19c9c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9be3324a-d055-4fba-a420-5522d102a2cc", "sighting_of_ref": "indicator--8f92bb77-c1a5-4bfa-a0ae-5e9894952df3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915a2e15-c4d7-4cad-8570-e199985e637d", "sighting_of_ref": "indicator--3eda8334-fc6d-47af-ba8a-4783a04c847a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6ee52a-e51d-4efe-906c-86346d5a3a1f", "sighting_of_ref": "indicator--f3893cb8-deb0-4899-a28c-f2c79e473bcd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ffc1842-d6de-4f29-932a-486d59b9c698", "sighting_of_ref": "indicator--b7119619-4cd0-4dae-aed7-65a255b48b76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c9cac03-50f0-42ff-a892-ff9811f518c6", "sighting_of_ref": "indicator--d71d01f4-bd7d-429d-a3dd-26cfe50dc0e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39729ac9-0795-4e27-9874-c764b429b2dd", "sighting_of_ref": "indicator--1ce40fdc-35aa-4590-a8e7-c0c3f53f764a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da3c23a5-8023-445d-89ff-404c65c034f2", "sighting_of_ref": "indicator--98a333ca-2aea-4a83-86bc-7b674fd9bde4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d51abf1b-eb0f-4514-b1b3-19760c5711b2", "sighting_of_ref": "indicator--eb40bc6f-8ec4-456f-ab89-2d48c756bf01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abcdb078-a073-45b2-9b78-da7a383907db", "sighting_of_ref": "indicator--1baca231-b83f-43ac-9756-2bf8a72b94bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9eec734-4490-420f-9e9e-7d39c1a0e185", "sighting_of_ref": "indicator--4fb0e6da-82a3-4f04-8958-b940514d4630", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--050a3741-30ea-470a-81b2-097cb55a91c2", "sighting_of_ref": "indicator--b38ede7d-2d62-4053-af44-1401e9acd48a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf3329c-c112-4e43-9462-479915fc0331", "sighting_of_ref": "indicator--e71f1965-7952-4cd7-8867-b9a2e839f902", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7546524-5fea-4cec-aa36-05437cbe4a7f", "sighting_of_ref": "indicator--b0a630a2-1094-43ce-b73e-2e60971da4ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abbcd317-df5a-4d13-ba8a-b9c1cd0da253", "sighting_of_ref": "indicator--a457b534-9fa2-4f6e-9f14-595b85d8bb15", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f923fb8d-175e-4ee8-8bee-08fc3b9cce08", "sighting_of_ref": "indicator--16761f78-3c45-4c5b-a277-acbd387b39b5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d109c42f-0972-440c-9ee4-d30e6e2b3c00", "sighting_of_ref": "indicator--5688b545-7e90-4f14-a2a0-b135504ab97e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bb34be7-05e8-4a4e-b89b-7384df2e6b76", "sighting_of_ref": "indicator--d4f33544-7fe2-42d6-8904-d65952505d2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b40db294-0e5d-4696-8730-ad667646afa4", "sighting_of_ref": "indicator--05b59d8e-92aa-460c-aae3-5e477b1a904e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e25fddcd-78aa-44b7-9b2a-1efca433bc56", "sighting_of_ref": "indicator--e9ed6fcd-b1e3-4726-958e-24fdc8d73ed4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79ef528a-c4d6-4a69-b322-bdd3fcfaba6f", "sighting_of_ref": "indicator--45cae13f-3080-4472-b493-768fd8a5a887", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82dafe88-6222-41a1-b04c-2a27e462e1e4", "sighting_of_ref": "indicator--b9180b94-fdd2-4bf6-a2c7-1306e6abbe6b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61205a8e-5639-4f16-a0aa-e87bfe97b416", "sighting_of_ref": "indicator--24024e78-ab03-4762-8b37-58f24ce0c777", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34ec847a-b479-480d-b93b-dc7db8697bff", "sighting_of_ref": "indicator--c5e42091-118d-4547-b5bc-05fa05011ef1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a51f520-1b9b-4c1e-8044-82ee087379c6", "sighting_of_ref": "indicator--4072841c-2e59-4e2b-ae7c-6ae7ce327eb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d45cd7a6-3925-4c5f-a8f6-c0c10e8d1f4b", "sighting_of_ref": "indicator--4e101669-60e6-47af-8fc4-0d392a874bf1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83095690-71dc-4bb8-b65f-04ef0eedbde1", "sighting_of_ref": "indicator--90b23ec0-b132-4399-946b-06faf787ed38", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbc29e3a-aa92-41e1-97e5-8b208f320a63", "sighting_of_ref": "indicator--1cafbe4a-38cc-4c11-8124-c9e9b1a0cf3d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84647a59-a52c-4140-b15b-b5248146cf08", "sighting_of_ref": "indicator--12989d7a-b850-4a6a-a128-176f38e30a43", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4745f482-462a-4351-bc8e-ff60858d76a5", "sighting_of_ref": "indicator--afb1b6a6-310c-467e-b6ab-0ad9d087cbab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--034d31cc-5826-440f-aa2f-4a077eccfe4b", "sighting_of_ref": "indicator--04500178-c13b-4609-803a-4ce999377d9d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e7872a-08b9-45d4-a36a-ca6808b5d1bf", "sighting_of_ref": "indicator--7e72e47d-489d-4c57-a384-5bb210eccc7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18ce903f-b96c-48c4-9a31-8b29d9f53c6e", "sighting_of_ref": "indicator--01765d49-2870-4be3-8889-271c568b3eac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d2d9fea-12cb-417a-9d4d-e3d990a8cc8d", "sighting_of_ref": "indicator--48806c5c-ae26-43f4-997e-83f5c27659db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dc3fb0e-4c4a-4a31-966f-279bedaa742a", "sighting_of_ref": "indicator--f7d99bca-0370-42d6-a4ac-6af27cd86565", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38f22245-8564-4a18-a20a-642e1b05a005", "sighting_of_ref": "indicator--bb14d129-9763-4986-988c-5e2662e0ddbd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f265daf2-8b1f-4e1e-9b92-9714e3006143", "sighting_of_ref": "indicator--702ad605-c4f4-49b0-8860-527d87f87ffa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10e01d7c-25e5-4243-be15-dbb22f88407f", "sighting_of_ref": "indicator--fdbe10a7-605f-47bd-bd60-14ff27a14910", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b8eb536-5d1c-4c15-acdd-0ef43d5747ae", "sighting_of_ref": "indicator--e0e2fa97-60a3-4689-b728-b718290af738", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0566e232-a38a-4394-b248-41ee34df0cf3", "sighting_of_ref": "indicator--b8f67b0f-6a42-48af-8a41-40106aedb0f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12141157-ca29-429b-8e82-4479f2720fff", "sighting_of_ref": "indicator--691b3a31-c5a0-4a9e-b40b-e5ffa4d3a87e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7973ef-c5fd-4041-b807-004dd253aafc", "sighting_of_ref": "indicator--8b957d17-470e-49a0-98ad-651cf1b5d944", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3f9ca7b-554b-4153-9007-590f82e252c9", "sighting_of_ref": "indicator--2d9c326c-807e-456b-ba4b-5fe7eb472261", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3b0251-69e1-463f-bc4f-fb051a619ead", "sighting_of_ref": "indicator--aab4b75e-651d-4b8c-8791-71e75f766f57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54acf64a-acaf-4ee8-8c71-4bafbed6f5ef", "sighting_of_ref": "indicator--345e01c1-04c4-49d7-9d42-f3037bea00ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--492a7d4a-cb37-46ae-a772-e4dbb92f3ed7", "sighting_of_ref": "indicator--d3cf2dc0-3cff-4215-9644-dd3eee621de1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a2e292d-710a-41b7-a2d6-6ca4a8ae28af", "sighting_of_ref": "indicator--04adfd62-79e3-4121-8555-6cf77fb8bc9b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30f42815-bfc9-4a00-996d-89d439cd600f", "sighting_of_ref": "indicator--890670a6-ed2e-430d-a108-7f3418c23af6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3afc4d-fb5c-47dc-8e84-6d4674413f5f", "sighting_of_ref": "indicator--11f5f5f5-7a41-4b20-b74c-f11d08d8fc18", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c31231eb-5fe3-4d3d-9b66-a9188663b66d", "sighting_of_ref": "indicator--369b6ec6-efae-4b52-bfcc-315bf06a1acb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92bd0143-00d1-4940-b570-24c4a290528c", "sighting_of_ref": "indicator--a18eb316-e015-4a3c-a845-87a6c6ed2fee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2655d9ae-6c7e-483b-bc5b-8de5fc19ad11", "sighting_of_ref": "indicator--7f755f54-4523-4b0d-8444-5ba2af2a45fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd5811e7-bf76-47ed-b10c-11daa562f8e8", "sighting_of_ref": "indicator--0f21ce17-af80-4575-8941-6c3a43b65a6b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc2c63c6-c5f3-4afd-a24c-d9ec034aa593", "sighting_of_ref": "indicator--e7c39060-d007-467a-8b79-3a3eaecb412c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11082bbe-b395-4696-bd75-98fe4feb9ebb", "sighting_of_ref": "indicator--d377b89a-17e0-45a8-88d5-e144a0e5f07d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c1681b6-d8f7-4be7-8895-01854c6e434c", "sighting_of_ref": "indicator--f3d30775-da2f-437a-8ac7-7d34d21e83ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9684ec93-309d-4bad-9241-1c3c831c2bf3", "sighting_of_ref": "indicator--851843c3-e3b2-4d35-9b63-da47d73630a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f4037e-0349-4897-8a73-72c3535bacb0", "sighting_of_ref": "indicator--184f22bc-531f-4098-82f4-5d576f33a881", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f57160c2-b03f-42d8-bfc8-2854d13caaa9", "sighting_of_ref": "indicator--7886b18b-c9a5-44b5-9415-c3a8aaf2c1d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee838c68-a443-48ba-947e-fa2826864d06", "sighting_of_ref": "indicator--57cd317d-cce0-45b6-bec4-32855772c39b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07e5707d-86f4-49e2-89dd-f27a59997e47", "sighting_of_ref": "indicator--3bc8778b-6563-42a3-bcb3-7c8959fb444d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df05aa93-0737-4d9a-be45-a5c1fa1b5cdf", "sighting_of_ref": "indicator--2bc4e986-5129-417f-96d8-772f07622614", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98207958-eb50-448b-8555-73a25a375863", "sighting_of_ref": "indicator--649b7371-20c9-4b20-91bb-766f006036cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ded7fad-9568-4701-a7db-22d9910bf3b7", "sighting_of_ref": "indicator--13f2bc5c-27dc-4e93-8081-5d7247626a2d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dd64953-fdbf-4af2-b3be-d04ad8c82efa", "sighting_of_ref": "indicator--7f13d2c7-ebbb-4a66-b0c1-fbef568db7c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--903db579-d977-4210-8068-35668de0a97f", "sighting_of_ref": "indicator--b440f6b1-454c-4d51-9ae2-2a0f7922521b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0769a742-711e-47d2-afd8-d7fea92359dd", "sighting_of_ref": "indicator--f662656c-9df9-4b55-87dc-e25ba7b8d9da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c962eaa3-55d0-4d84-afcc-a32fbe7592ad", "sighting_of_ref": "indicator--b7750c4e-6555-4038-9472-af8bfd6ea234", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2456fd32-3d50-44ad-b619-652632de3cd6", "sighting_of_ref": "indicator--25054994-eeb5-4ea8-a36c-f935c5369455", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6f92228-948c-4bf8-83db-8917b79cb96b", "sighting_of_ref": "indicator--5ec31552-3668-4f0e-988e-684bcdff840b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df842dd0-cd16-425c-9454-3dd32932feb5", "sighting_of_ref": "indicator--5ffad1b2-3bb3-49b8-b208-4a61e328bb47", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19a96089-a9fe-4d4a-8c61-be1774c5dbe6", "sighting_of_ref": "indicator--fe1a3704-6d7c-478a-b473-7b60365e98e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff1bab71-aa5c-41f0-b18b-d8cdd896b7d5", "sighting_of_ref": "indicator--b4df900c-3ac3-40cc-be0e-9cf2b9220126", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f11af2d7-7862-4ef0-b3de-37df8714f6c4", "sighting_of_ref": "indicator--e5dd8848-c2c1-4199-9408-54718e739719", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29a26d86-1ce0-493a-8ede-8022fb9c9bbe", "sighting_of_ref": "indicator--71982165-71ef-4124-8ff9-321add574cd9", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd05db08-88af-406d-af01-07bae11f868b", "sighting_of_ref": "indicator--849a2119-5f3e-4e87-a97c-633b039ca43b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d4cfe3-8122-48c9-8414-dd29c385c7a8", "sighting_of_ref": "indicator--3ad6ca03-9972-4e0b-af44-081c6dd668c0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29d7f2c0-8869-468a-8358-a3f51d03049f", "sighting_of_ref": "indicator--e7312a10-80b1-4c96-8fdb-b5d9a327ce90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d601895-7d07-405e-9b48-22120e6b7bcb", "sighting_of_ref": "indicator--0a481e31-f4f4-4b02-9069-d9f5ed93c319", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df93ba52-857d-4368-a781-3a4ebbdb228b", "sighting_of_ref": "indicator--fb8b8d28-1835-4f1d-b4ba-2dd71967486d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18a56840-9440-44c8-a823-9587a1ac9691", "sighting_of_ref": "indicator--1261a371-e9b8-47ea-954c-35ec51071c27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc1b2248-a3e6-4a90-927b-a0ceebb10fd9", "sighting_of_ref": "indicator--c9567d8c-1707-437d-94d2-fdaaeb53c5ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82f7865-2e84-45a2-b861-cad3a5ede4da", "sighting_of_ref": "indicator--3af8d857-1546-4199-b1d7-f9a487f7f816", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4717796-39b3-43db-97cf-0582701f4a22", "sighting_of_ref": "indicator--4dbf9a58-adaf-4fd6-96db-c47b1256cfac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f9a56e-57a1-4a6a-9387-f72843510eb2", "sighting_of_ref": "indicator--a5fc00f8-1fd1-408a-b608-fbeabbd1d186", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f31827c0-bb4d-4f0a-b2f7-e2752cc3aa0a", "sighting_of_ref": "indicator--9ed25618-89cc-4c08-b404-e6bfaa0173ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a4409cb-ea2e-4367-b8b8-507478fd7bbf", "sighting_of_ref": "indicator--c59b4d2c-43d7-4e92-8568-5184cd9c11d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--812971b0-c2d2-4115-91a8-1a9889288f38", "sighting_of_ref": "indicator--005e177c-6b5e-499d-8725-27e66699374f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0189ac8a-6923-44fd-a23e-4570061099ce", "sighting_of_ref": "indicator--7305529c-8cf1-4b1c-a623-16356be64409", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38ce0627-bd46-4126-9cf3-a811db1a48b3", "sighting_of_ref": "indicator--b140cb68-2110-4a92-b99c-77cf6762fc37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d5f970-b133-44c6-9a31-de5c1953b922", "sighting_of_ref": "indicator--6f80d6d5-66ba-49db-bbbd-290e3e13f2fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c0ff5d7-57de-4bb2-8357-2bd6bc08697c", "sighting_of_ref": "indicator--9ff381b0-8dab-4014-8114-ee6b960c6801", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--429083b2-5623-495b-8fc0-35a377d1c186", "sighting_of_ref": "indicator--9eee05b9-5d28-490c-9e55-454c9e9dcacb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811d36bc-0d3d-4e4c-93f8-854b9589a7b0", "sighting_of_ref": "indicator--4e7bf57f-5c98-4067-a92e-4d40f5332489", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78fcd71a-5f89-4451-8610-6d81f1a29cff", "sighting_of_ref": "indicator--e42caa6b-b633-46ea-b007-af967cf81710", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4cd255-2907-4578-9006-7dcdfdcce785", "sighting_of_ref": "indicator--aa495049-6c18-4bf1-b610-2aa8b3f6632b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dcf60a9-41f3-4cba-bdbf-ca4d32188881", "sighting_of_ref": "indicator--a50d0203-534d-40ae-812e-540c3dcacb93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf20217-c6b8-4f6c-848a-aa4330dd3879", "sighting_of_ref": "indicator--613c004f-08e3-497f-8f72-3ca0180df4d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e85d98cd-1784-44ea-95b5-5bac4ea702cc", "sighting_of_ref": "indicator--5030306d-f0f7-42af-99af-86f502b6c214", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52f2da61-89bd-40be-8073-9a411623d0f4", "sighting_of_ref": "indicator--37386a98-1b84-4c6e-be17-d77f6cfbadae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a00ff9f-8b3a-4c88-949e-5be03b1a1708", "sighting_of_ref": "indicator--9a4ba885-bfb8-4f4f-918a-5ab7842a377f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b182ce4b-92c3-47fc-a8c9-14c07aa3e389", "sighting_of_ref": "indicator--65d0e282-48fc-43bd-9585-43c9a9aa849e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6cadb81-b91c-4378-95d8-a093f8aa0614", "sighting_of_ref": "indicator--b39a1e11-0179-4c98-82d8-0e1e0e85dc26", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa667f8e-488d-416c-83a1-e4c6026f988d", "sighting_of_ref": "indicator--ec1b6a64-5f9d-44df-b53f-61dd9a61cf5a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ae35c95-f0ce-452c-9c9c-193198872d7f", "sighting_of_ref": "indicator--7bf22251-f5db-4722-9ee0-f89ba94630e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40c75552-3353-4ad3-9020-8b79a1ef0cce", "sighting_of_ref": "indicator--b100b7ed-8432-4b8c-a596-291d06996969", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef3e6b08-6595-40f1-8557-bbb6961efbb5", "sighting_of_ref": "indicator--263418d5-b5a0-4a79-8335-c0ee9eb3e5aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1247e50-5245-44d7-8f5c-8e50b854c046", "sighting_of_ref": "indicator--9ac45d70-a0c2-4c4b-98c4-f9f68e0c8cf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c88a9d-b45c-4f6f-9eb0-74152b62e759", "sighting_of_ref": "indicator--30b241b3-04b6-49c9-b0b2-1cb061457bdb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--733f6ae4-10fe-445f-9abe-9b0d8a3ddb4e", "sighting_of_ref": "indicator--8e6b2b79-0675-41be-aad0-988128e60f1c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba2abf3-1775-46d1-ac39-65f22910f200", "sighting_of_ref": "indicator--1ea1cd9f-dca5-4d16-bfe2-fffd575d6cc5", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76532f77-8edb-46d7-96b1-b4a9016c95e6", "sighting_of_ref": "indicator--31ade283-ed6e-4fab-bf96-68921b0336ff", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99a1042b-2776-4156-84a0-80da047b527a", "sighting_of_ref": "indicator--ad0c1e9b-088e-48d3-a64e-2da1f30a8e13", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d6fa8f6-7dad-431d-82d4-56ef6e8e4a99", "sighting_of_ref": "indicator--406a8097-55e4-4016-b592-34ae24e1b2ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34cdb12f-3468-4bf9-a5bb-1abb4b93b369", "sighting_of_ref": "indicator--7dbef670-784a-4095-b5eb-cbb87bd343b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fcf62f0-19a4-4a88-9659-9f4575d55319", "sighting_of_ref": "indicator--50016804-abb8-4b07-99a3-3b2db5fa04f4", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2814cbb-b8b9-4b0e-b238-c4bd7ec86ed3", "sighting_of_ref": "indicator--b4237ffc-7a63-4ffa-a288-4e1cb9286fe9", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c400319-5f6f-45af-8378-f7746c90c556", "sighting_of_ref": "indicator--cbd5e0d7-211e-415e-9568-bc5d24c6ed19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb37db00-9c76-4f80-a5b9-fe884ae42a8f", "sighting_of_ref": "indicator--35040d9a-9643-47c4-a9b7-74d7894b996a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655a8003-bdc1-438c-a12b-7383f23b5f6e", "sighting_of_ref": "indicator--09be2e6a-ba8a-46cf-b8b6-aa68c022f872", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dee7b6fd-1ef9-4936-8651-f4ecb9647d35", "sighting_of_ref": "indicator--ee1b919e-71a2-419d-84a0-a534d72a400c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24fb9b9-a45d-4312-8328-de4c3dcdfb1c", "sighting_of_ref": "indicator--3f779444-07db-4d9a-babc-32349577ed1e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5205c4d-38e8-4014-8570-5b93a9152441", "sighting_of_ref": "indicator--4d7fec92-9393-4f37-a7ca-db49a79af25d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--289f4233-1804-415f-be86-737a06b0bf12", "sighting_of_ref": "indicator--4d7fec92-9393-4f37-a7ca-db49a79af25d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12de3105-1296-491a-9cc0-db30185d3142", "sighting_of_ref": "indicator--d4f12727-6292-446f-b352-4543aca8a763", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed7a8204-1de2-47d5-a588-f76095e6d8b2", "sighting_of_ref": "indicator--3b78ef29-e9bb-40b7-b665-e046a4ccb89e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0728a578-c6e8-49e9-ba35-9fc6fea6b92e", "sighting_of_ref": "indicator--ec14ece0-6595-4d41-8f9b-1945ab1c9084", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a15a17-ed3b-4113-b2ca-c897ee9db206", "sighting_of_ref": "indicator--425fcaf1-b6ee-45bd-8373-962147ad730d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1cd3a01-048d-46a5-997a-a0a77eb0aacf", "sighting_of_ref": "indicator--e49b429e-89b5-45f0-ab4d-3fd1becdc5ac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aeb07d1-ffe6-4f36-ac2b-b5920955f1ff", "sighting_of_ref": "indicator--90c6fc90-d6ac-4d36-b7d6-8eb39a309784", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6794c868-f7f8-4be8-9568-58692547dd64", "sighting_of_ref": "indicator--17830775-74a6-4253-a74c-4a19cd86049e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--274ec3aa-0e2a-4f2b-a7c0-a484c11e8db7", "sighting_of_ref": "indicator--0c3fc660-d5aa-41c5-9ef3-67dbe3da5b6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47b7ff1-52df-4f60-976a-3c1d7697066b", "sighting_of_ref": "indicator--83af0fa7-5073-4dec-b782-20645b382cc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--797a0561-1e6c-4dd3-818c-2b269d56a714", "sighting_of_ref": "indicator--24042b52-91ca-414b-99d4-62de37e2a5d2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede49d96-4fe2-4b63-a0c5-12889653aba5", "sighting_of_ref": "indicator--8d116b84-53f9-4694-b619-6c232698dd4d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1413aa0f-bd26-4c25-9cb1-4b37e322cef4", "sighting_of_ref": "indicator--03c2af28-03f8-4748-977a-65692e7c0657", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75832f07-c49c-4ad9-869a-bdf07eaeb3e5", "sighting_of_ref": "indicator--3cee16ac-f5ef-465d-b314-2822e36751e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd793af9-1c01-441b-bf38-f06e7a283625", "sighting_of_ref": "indicator--027c6c08-8ae3-4467-bb79-cdf598c67aca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99b0a15-633d-425a-bf8b-fff7b283e56f", "sighting_of_ref": "indicator--e35e66fe-ae7d-48fa-870e-79308447a903", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8a939f0-93ee-4d38-a256-00d42343455e", "sighting_of_ref": "indicator--49ed25d5-2194-47fd-ab3d-a9bae63f0182", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79078165-27b4-4c7c-a041-19f8f5689bd7", "sighting_of_ref": "indicator--c720d03e-f929-44c1-8959-d80db9661cd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad43efff-c9f3-48f5-a40d-2466717b3445", "sighting_of_ref": "indicator--8e8e64be-5a04-414b-800b-40bb9a1bb62e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c9f1ea-4c10-466b-aa5b-3ecf1213356e", "sighting_of_ref": "indicator--de2ecdd7-a7b7-407f-b3fd-91fa06b99f94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac50af6c-0154-44ca-b8fd-a4bd9f9751a0", "sighting_of_ref": "indicator--03d47908-1616-4392-934f-3d57abf341e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c9a5d1-b965-491c-acaa-304491140995", "sighting_of_ref": "indicator--2040b1f9-1a57-4901-8432-4fb9e3ba57a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d75375c-04b1-4009-b909-e9b227813a29", "sighting_of_ref": "indicator--ffc1dac9-5397-4e9c-bc5f-181c9a26a224", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57fe1f56-cc1b-423a-8e98-fcfe65f0899d", "sighting_of_ref": "indicator--30ac66ed-7278-4036-9f7c-fd48829503df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb4bcbd-6898-4463-a02e-5210c26b68e6", "sighting_of_ref": "indicator--2bf6414a-bbda-4ce6-b75b-ed1aef90ae99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7c67d2d-df2a-4463-9e20-0c7de0c30cd1", "sighting_of_ref": "indicator--79eb876a-b20f-4845-8174-7b584b71a182", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39b443dc-5143-47af-a883-428cdacae4d7", "sighting_of_ref": "indicator--240d07e1-225d-4404-a814-7bb8ff8d6f56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ccdd0fa-0439-4714-abbd-f2295b5e40ca", "sighting_of_ref": "indicator--60ff0c90-f3c8-4714-bc41-143d2421420a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08f769be-b918-4565-8fef-46845b2ffb9e", "sighting_of_ref": "indicator--b6682889-d544-4f67-80b7-7444099104e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309ff4f9-a925-497b-8ae3-5bbb6c4ce160", "sighting_of_ref": "indicator--0039da4a-0f1d-4d8a-88f2-e59a2f5a65cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aebc544-159d-4ceb-957a-54120590d38b", "sighting_of_ref": "indicator--070437ab-b986-45c9-99c1-e1194e0e81cd", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b35c0c-606e-4d9f-914f-f03127ee4441", "sighting_of_ref": "indicator--9ad47c86-44fc-4fbf-b48e-acae552ad5ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e723494-b3b7-42d2-b2d2-55c2184d90ab", "sighting_of_ref": "indicator--1364c833-af60-41df-a4a4-15a064075cf8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb3acd9-82b4-4d1c-b231-07c1701e77e6", "sighting_of_ref": "indicator--781b65c0-c85e-4d52-9d92-74bbcc6e1b60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71d4ac78-c5b9-4d5a-bb9b-a57407155f4a", "sighting_of_ref": "indicator--5be6f6f8-b799-4722-91d5-fffd5c27ac5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4a66e0-4d42-490a-9c8b-b6a0ffe678c5", "sighting_of_ref": "indicator--a430ab84-d583-46d1-8897-bbdf1788a0ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af9a9ad6-d18f-4c8a-a353-8654b19e953f", "sighting_of_ref": "indicator--c14e6ea0-9917-4690-8078-cfbce29ebc45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b76d74-87ab-4a73-b725-ffc2022963e9", "sighting_of_ref": "indicator--f5f46349-6c6b-4d21-9a43-1f631d92e14a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d5de3c5-a5c1-4f92-8634-14781f008b5d", "sighting_of_ref": "indicator--69ee7616-9a7d-4cc4-be13-8461676c6052", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c786d951-dc9e-4bb3-95fd-5d8a349f897a", "sighting_of_ref": "indicator--adf90e35-b255-44f5-9dce-2cb4e2ec3cbd", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--903fdfff-60e0-4e60-9b6b-c149c6bc759e", "sighting_of_ref": "indicator--a0323be3-469e-4357-95f2-021343dcb181", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81916a2-161a-4df2-ae95-7adc8f5b3b86", "sighting_of_ref": "indicator--5823c35d-716b-49f4-9308-4fa21c5a5c53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e580888-abcb-4ca3-a9b4-3070e73a675c", "sighting_of_ref": "indicator--30e9da44-0716-4740-994d-ebf61c97a8bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b6c15e-d39a-4668-be11-81f20e757216", "sighting_of_ref": "indicator--27724994-29dc-48ae-8657-3729c6210238", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50d94bbb-34ed-4818-8b61-47f80b47566d", "sighting_of_ref": "indicator--3d2eb533-a27d-4752-8064-f5e1e57f3383", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bf80a37-8c75-4544-b5b7-51400f681e6f", "sighting_of_ref": "indicator--9c3e95c8-92aa-45b0-aacb-467a1c8a8c20", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77ca9914-a386-4723-b107-06326fb6e3b2", "sighting_of_ref": "indicator--f719997b-7f3a-405b-be6c-6432589bbac1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe3a77b-5eef-4f98-bae2-ce279764a8f4", "sighting_of_ref": "indicator--f9e9a384-ab29-44bd-90dd-8f883f14519d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64bdbbf9-fa10-4997-9da9-b13364f3c29d", "sighting_of_ref": "indicator--7914d932-6a50-4ae9-8eb8-b646b51d889c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c21acf54-735e-477e-96e2-a11f187dba24", "sighting_of_ref": "indicator--82bc2302-5c25-4443-b155-6338a449760a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11159c2f-7c71-498a-951b-bce7bb2c8179", "sighting_of_ref": "indicator--981365ec-f296-406c-8766-392d9e0bc190", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2d30b9-e140-4465-9761-d9df3ce3e79a", "sighting_of_ref": "indicator--75bd1694-2b97-4759-9f70-851a4e9c2045", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b2339c5-f365-42e9-8ed8-b585c94f9884", "sighting_of_ref": "indicator--6cd00247-641a-4246-bdf9-1670c295ebde", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c2dcba-e7d1-402c-9c74-6f82beb36ce1", "sighting_of_ref": "indicator--e3930a76-b8dd-43f2-aea9-90f9b8b9271f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb0b2798-9589-42d4-a497-e395d7d68151", "sighting_of_ref": "indicator--e424c2d8-256f-4d47-8f8f-161dff22a2c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3ae5a80-490c-4a19-9962-67dcda4f590f", "sighting_of_ref": "indicator--90917e94-f24c-4aa4-87bd-3dc83632367d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6013a231-3320-4400-a5bb-3048240d8f5b", "sighting_of_ref": "indicator--83f54c1e-0ae0-4680-8766-5fda1b3e2c1d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ecce7b-3e35-4afa-9da7-aff168108bf9", "sighting_of_ref": "indicator--40212981-7b83-4eb4-bd97-bb786125aede", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9a3c4f0-5952-4668-bb1a-2dca4d591e0f", "sighting_of_ref": "indicator--3b2cb6e6-ae04-419c-b9b6-e72ffbfa87dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4582480c-e9b3-4bf6-8158-b545add78b68", "sighting_of_ref": "indicator--5741ce02-d05e-4952-baa4-28dd1b6ed611", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8011b744-262b-4cda-811d-9e02ff14f253", "sighting_of_ref": "indicator--aad6e751-59bb-4e2a-a54c-3e52fe2f39bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf0f68b8-a3e3-4ef9-b25b-759c07c627b0", "sighting_of_ref": "indicator--e166c825-49b9-4ce3-9d33-ce0898e10dc2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba375375-ce46-4fb6-a414-16a0e614f7ec", "sighting_of_ref": "indicator--8011b321-8bff-4e49-8b8c-99b8386b0868", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c27ca35c-a2ef-465a-855b-e1a892aa40a3", "sighting_of_ref": "indicator--e74a3bc9-dcc5-4582-a43b-0bb5e97d1538", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c27688-f1aa-4b23-b03c-6d7a354112fa", "sighting_of_ref": "indicator--1cc35c73-3860-4649-ab0b-57caf93fb20f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76805b16-c00c-4573-9cf1-3d8196fc957d", "sighting_of_ref": "indicator--e0b88790-5938-4221-bfb7-d1e536404211", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01b024fa-b8ac-49e8-a0c5-68d3ac5d3f4c", "sighting_of_ref": "indicator--63708f6b-814c-4d23-b6b3-165327cb8e81", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eba835e-ac95-4b9b-ac20-bde05d8f6269", "sighting_of_ref": "indicator--b65ca8d0-d7bb-401e-8fd7-8b047db60aa3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4d3b4b5-c35e-4b28-bd26-cea93b117530", "sighting_of_ref": "indicator--5ca6aa66-301a-41dc-b8da-21e207423ec3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a124f033-adf4-4397-be86-b2ea453e9e3a", "sighting_of_ref": "indicator--112520ec-b216-4420-bf3a-7e7fa8559a2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff8eed0-ab21-4218-9170-798c365edf06", "sighting_of_ref": "indicator--668c26b5-02b0-4373-886a-7b7f05ddb07e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172e822d-61ca-4b20-a429-044a961800fe", "sighting_of_ref": "indicator--e8c3cf03-6ec4-4ff2-a98c-ad94a8ee4dc6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6831bc46-ba53-4144-ab09-f6fb0d44c2ec", "sighting_of_ref": "indicator--405a3729-c41b-4176-8152-f96246d7bf34", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a293627e-5820-42f3-b55b-bd25308b5f19", "sighting_of_ref": "indicator--ca885dab-d2b7-4dda-8ca9-457526968c87", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--923ba771-e9ba-4f6d-bf81-cf89435d2d91", "sighting_of_ref": "indicator--a7809cc9-9d13-4d4e-9d8c-ef8c2e99164d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d793646b-1bdf-4f37-82b7-d4bc8787d0c7", "sighting_of_ref": "indicator--fa975d0f-d0d7-43c0-929d-5186272fc085", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb288c65-9bf3-47e3-8a13-acf2c7b65f8b", "sighting_of_ref": "indicator--69f6b8e0-7dc1-4f2b-a6d0-7dd4c3c52202", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae6104b-2d13-4602-9464-6693354d8eac", "sighting_of_ref": "indicator--f8d838f9-a288-45b6-a605-a8bb91cbf37b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60006e22-1afe-46de-a37a-4fb44a50a50b", "sighting_of_ref": "indicator--05a82a48-e71d-4a65-8bfc-8dbe87f4be8a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8a18ac1-f8b2-4ae0-a9b4-d3921ef4c18b", "sighting_of_ref": "indicator--d0f297b9-70dd-4624-81a0-15dee4592d6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a02da12b-6f36-4e8a-b83d-5daf4b98cb2b", "sighting_of_ref": "indicator--b13283ab-6bfe-4bde-aada-0d1db1876238", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea36428-91c9-4fd7-98e3-f9fcff98dc47", "sighting_of_ref": "indicator--880ac684-a80f-4f63-b73a-606da781ad4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3b44dcf-1400-44d5-ab22-e563c7b3e437", "sighting_of_ref": "indicator--f401bedd-19d9-4eba-8250-16d655fb21a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9468bb0f-e9d9-4382-ab39-1ec8a303e2c6", "sighting_of_ref": "indicator--d846f964-3465-46e2-9113-45e52c954ea6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--418bdd1e-0f4b-4301-a54a-e005e304335b", "sighting_of_ref": "indicator--b9524867-8719-4f23-8c43-dd63c6c6b5ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e60b36a-547f-4b85-87f4-b5e2f1543b71", "sighting_of_ref": "indicator--93188407-f586-4cfa-b4fe-3dd588816842", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898af455-73f5-4956-a666-0a58421a7044", "sighting_of_ref": "indicator--6f60b784-297a-4660-99ba-a16a437d3a5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10c5fabb-7cda-465d-ace6-e09ababb37a5", "sighting_of_ref": "indicator--57939675-c347-4b2f-868d-25e2057b996b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2da19f9-a074-4295-9075-e997c2e138be", "sighting_of_ref": "indicator--fcab8268-c2bf-451d-87b0-e6f9e441c69c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e3501d-ff9f-4353-b835-479c4d2c9a13", "sighting_of_ref": "indicator--90c9b287-feb4-4375-9cd6-94d1a3dedbe8", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fcc6f0b-c427-4d2c-929e-1d801d207875", "sighting_of_ref": "indicator--8e31ccc2-d336-4afc-bfbc-3fefffef8a1e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4efde0-756c-46d7-b4b7-32218073596e", "sighting_of_ref": "indicator--82b59e6b-499c-4b02-aac9-1f27c24cff78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477b5fae-f4cb-4fd3-8f64-0c65288b6532", "sighting_of_ref": "indicator--e6ff7ada-9ee8-4392-9449-d01422ebb213", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16154439-b1ce-45b0-9b5c-cdd479fbe238", "sighting_of_ref": "indicator--9369696c-2f35-4699-9a34-b52c9b8b752c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30396077-79c1-4aca-b2b5-b2fee9c6a4e9", "sighting_of_ref": "indicator--eca2de76-ff2e-4eaa-bf78-9b945a143f4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1be609-e5d6-47b8-bb85-d9228a9f4803", "sighting_of_ref": "indicator--c3652924-7da6-48ef-9c9a-6d51bb8eb1d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c31974f6-66ae-4144-9925-4f00f91b5b6b", "sighting_of_ref": "indicator--b76ee372-d0a5-4ba1-8b50-8581fe3aead7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03fee988-0b74-4084-b7b1-2997d365cfe3", "sighting_of_ref": "indicator--d935f821-4d7a-4ec4-9ace-208bcf1f5ddc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64492154-4a25-418d-a9c1-6a4b56a6544a", "sighting_of_ref": "indicator--0dccbad7-1e4f-48e3-b425-399995353f92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7cf743b-b69b-4d91-90ba-aae140ebe522", "sighting_of_ref": "indicator--b621ea52-4d66-41b1-988f-a83f8fb37d03", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5014a9b3-bec4-4242-a981-364b7ef69977", "sighting_of_ref": "indicator--e9efd717-5757-4f2a-8eaf-811f4407c846", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14cd13c6-37a3-415c-8c40-7525c56cc209", "sighting_of_ref": "indicator--f11e2659-9084-497f-bc52-81ff25e2afad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab000832-4a85-41a1-9c1d-13a9cef385b7", "sighting_of_ref": "indicator--1ae965e9-a55d-4883-8b65-0c8a60f4ab43", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85dd57aa-7899-4b8d-851c-221655e0daa6", "sighting_of_ref": "indicator--ebae73db-f075-4332-a3a5-d56270eead3c", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4bc392d-0b16-46aa-b2ba-9fe5a5b88104", "sighting_of_ref": "indicator--ecf5f682-92ff-4e1d-a011-0a0575f8c9ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d54ee82a-8b51-4974-b820-42fb3b045418", "sighting_of_ref": "indicator--b1035a57-3625-478c-9a11-06db93146f1d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a84925-dd0a-4289-b26e-4c370a4c512b", "sighting_of_ref": "indicator--123df22b-47ff-489e-baa6-add3d66e3869", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3adf6c7f-1fa0-411e-a6b7-04bf03386f30", "sighting_of_ref": "indicator--04d47502-0c4c-4067-b824-dd99070e4681", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55f79d65-a024-480c-a3a5-5e8905d95f1f", "sighting_of_ref": "indicator--b800d5ee-89ac-4772-b558-a91055b28b56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13f2e902-516c-41bb-8aea-7dd4f71f3b79", "sighting_of_ref": "indicator--098f7a3e-0c71-4e6c-b17e-496e7fc861ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc890335-9f55-46e2-ab8a-603c6bd03a30", "sighting_of_ref": "indicator--f426ba86-c0bb-4c5d-9af2-cfcff8873cae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b99bafe-11a6-413a-9f68-8d908d14fceb", "sighting_of_ref": "indicator--805de21e-3f53-4bf4-9ecb-01d63f2f358f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d6bd48-174e-47a2-a60e-d79bd27a61bb", "sighting_of_ref": "indicator--2a5aa8d1-caf1-4d81-9055-7c5e8e8cc3d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f0ff944-7c99-4885-a0c4-991d5eaaaabc", "sighting_of_ref": "indicator--89b14441-ad41-4ba4-a754-4a671944ed5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c72813bc-4a26-4e74-a41c-7eeb29621d1b", "sighting_of_ref": "indicator--b9a2cd7c-ced9-489a-9d26-68a77340e7e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f72bf0-ebc6-4a3f-985f-554bff41efe4", "sighting_of_ref": "indicator--2020f53d-614b-4ac2-8a6a-70149cfa9564", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--883a298e-091b-42e7-80db-cb81b01765a2", "sighting_of_ref": "indicator--6beae9d0-68c9-43b5-867a-983030dc101f", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ceeb05-d4cd-4af0-9bbc-a372cadaf8c1", "sighting_of_ref": "indicator--1bdc804a-dcc7-4c74-9ec5-183f09dfecce", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--735a7104-b1e3-4c4d-bc39-de854b5db868", "sighting_of_ref": "indicator--97aa1704-533d-4baf-ac82-e9e0e0d9899f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4fab2e4-6223-404c-9caf-a66b55bb08d9", "sighting_of_ref": "indicator--a5101d58-d456-493f-bdc8-755bbdd90c3c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--469f3a8f-0878-4c19-89c3-90668c1b29c5", "sighting_of_ref": "indicator--46609a1a-219b-4dcf-9335-e30e537ca0c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfbb898b-7a55-4e51-ae10-123a76b02c6b", "sighting_of_ref": "indicator--1a2c92ce-a1d6-411d-b337-30eb93d582c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a5b19c8-bc61-45f2-abf5-373ba5e978a0", "sighting_of_ref": "indicator--e252e079-ea04-4279-be53-b1014fdb4b1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e533294-c627-47fe-a32e-81af967c7b1d", "sighting_of_ref": "indicator--4f12faaa-0f36-40ec-abad-264b0c4ca065", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc60d5d-cb51-4899-996c-e6389062503c", "sighting_of_ref": "indicator--12794e38-4635-4a72-b960-7f8952fc15b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e666e5d7-29ee-4fc6-896a-aa844f0b2048", "sighting_of_ref": "indicator--091b51bc-5006-41b6-891e-83cf60320bc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6393b70-20f1-4e55-8b48-1d4eab66d0a7", "sighting_of_ref": "indicator--28a211b1-a504-4d3b-ad76-1a48aec61baa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c14458f-7191-490c-a73d-54ab5be6e5d3", "sighting_of_ref": "indicator--d109d7cb-48a2-46bf-9eb1-98f8f0a51414", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f47ebdf6-ccb6-482f-917e-2609def235e7", "sighting_of_ref": "indicator--40f246c2-c46c-40e0-ab90-4c4b22942184", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb9f9d5-5713-4ab8-8ac7-da71c63848ca", "sighting_of_ref": "indicator--692213b2-fde7-42b2-8d0e-3550472fd7e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a69ff96-f6b5-4e6d-aac5-b05cfb191304", "sighting_of_ref": "indicator--c35dbe09-f31f-4b05-857b-27587f68f37a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22840279-2a4e-4f40-91d6-76f34f19dc4c", "sighting_of_ref": "indicator--864e5d28-d378-4f96-bd29-2fbf7a0daa35", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd0732c-0aef-4ea6-a514-712d717b57be", "sighting_of_ref": "indicator--42634b8d-7a1a-48bd-ab19-8cc89a2753fa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31736019-c85c-4161-bbdd-59fa885ba72c", "sighting_of_ref": "indicator--af479bb9-2186-4d4e-a48c-e6bc0ee8a0f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8cf2495-66d1-419a-9710-23d466071c3b", "sighting_of_ref": "indicator--1cf45aba-e783-4191-80fb-80ceb03bd1ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7d549a-872a-4cad-8d32-855c6ccc3b32", "sighting_of_ref": "indicator--d766ffa9-542d-4c84-8394-5085543d2b86", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41f9ea9d-7f18-4641-bc5d-468e3658874d", "sighting_of_ref": "indicator--59142ac5-42ff-4868-ac44-d8551d242456", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c65e131-2895-47c1-908c-cbc844aca6fc", "sighting_of_ref": "indicator--765eba35-929d-45b4-96c8-bd3e757f4d01", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c55ecb3-30a2-4b8a-b102-2a13dd0145f7", "sighting_of_ref": "indicator--334d595d-7e45-4770-b282-e7d4a8c247b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0375a69d-2fd5-4489-86c0-1370f0cc5aa5", "sighting_of_ref": "indicator--e600a14d-2c48-4b33-b99c-2fea1fe0c1e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff78d361-5785-4616-a908-14b9605142a7", "sighting_of_ref": "indicator--b843ecdd-4f9d-4b29-b206-f55dc3cd2ad4", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2362e70-9e83-4552-b26e-d74c7633364c", "sighting_of_ref": "indicator--6e29072e-c78d-44fc-b152-89c3179b2031", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c0200b-709d-4fc8-bdab-bd15c607492a", "sighting_of_ref": "indicator--10dd6753-43d9-4a37-87ae-44817f8b0e9a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f48fa3-1046-4f94-8322-20bcdebd0916", "sighting_of_ref": "indicator--5aaffa78-c95b-4210-b018-d4d270b4195b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29ccf2b8-25f6-46fb-9b53-24e0c7084fa9", "sighting_of_ref": "indicator--f14b7557-82da-4f64-8187-0762e3ce2449", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4039acb-9439-4298-af36-f7b8d1a81751", "sighting_of_ref": "indicator--2d118126-ed2b-4c3c-a4fe-76bddd16525f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfe5ad8d-da89-4b9d-812c-7b40087828af", "sighting_of_ref": "indicator--1da6f856-71ca-4d06-b59c-6f4ed67f5b5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f48046-813c-474e-af73-784632b57e01", "sighting_of_ref": "indicator--80240fd9-487b-4b89-8fc5-f986adaf2ac0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94dbdbea-18c5-4565-8eab-b6a74d0b8645", "sighting_of_ref": "indicator--53c0b28d-55eb-4934-b0e5-fce08cef934a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48b72950-7c78-42ed-8cb0-787f50171b17", "sighting_of_ref": "indicator--77efad9c-82e3-406f-91be-1bfe97c40f74", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--330ddd17-0f05-4a6c-a304-95a4c3f769da", "sighting_of_ref": "indicator--3e0935f3-cc7f-4d5d-b51e-a177b22934d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d6331bd-212d-4d22-90b5-9808161e8b09", "sighting_of_ref": "indicator--f6e22157-3458-4cec-b5ab-7d1ac96556fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4993f90-ff97-459f-9ae0-53b175509170", "sighting_of_ref": "indicator--03db3da5-cd3a-4236-8894-f6c50bcb0fff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7769bfd-452d-4489-9977-5cb05a4d0d79", "sighting_of_ref": "indicator--725fac81-0608-4117-81c8-71bcc94db6cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2030dd-1d2f-4661-bdd5-85a4b7502785", "sighting_of_ref": "indicator--8bfc088f-4afe-4e15-877d-7998d5499616", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--746b628a-c44e-4150-b01a-a858df6fbab3", "sighting_of_ref": "indicator--fda5a00b-f4cf-43c5-9a64-0fd1291c03c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b5c367a-c687-4015-b214-e2b2c6f378d7", "sighting_of_ref": "indicator--59e86da0-1dda-45d7-a5ba-8142488d911a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e2ffe8-1725-4671-b7e3-4a0403ce5baf", "sighting_of_ref": "indicator--5e33dc7f-3709-453c-8b93-c453bfaf6cd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a379f24c-f050-4bf5-8624-75494b47e655", "sighting_of_ref": "indicator--3198edbe-7735-4b7b-83dd-ee7ef7ff2644", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12e6d50b-eb4b-4e6e-9c41-552b0bb0499d", "sighting_of_ref": "indicator--e19cdcdc-f3c3-4600-b71b-6da812c5ec45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0096d3fc-56f7-45fe-818f-6985e65063c7", "sighting_of_ref": "indicator--8faae79c-27d0-4ef5-89c8-1f0c48e478a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4de10d-9ab3-43c8-890f-11b91f5635be", "sighting_of_ref": "indicator--49296c74-04bd-4daf-bb6f-8ae1e901cb94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97896e95-85eb-4d03-8987-98484e957b1d", "sighting_of_ref": "indicator--d3975455-c017-49be-b52a-7d302da65fad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--142867d8-9f6e-4440-bb03-000631d621b7", "sighting_of_ref": "indicator--1dd70f0c-819b-408e-b6ef-ffb507511b12", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa26790f-724d-4d27-9502-35a583c58c07", "sighting_of_ref": "indicator--0eebf057-5fc0-4c05-880c-4b6760b43bd7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f8289a-7ded-46bc-a736-1f50f004bce6", "sighting_of_ref": "indicator--2e05bf7e-4854-4666-89d4-d6e870a5c13f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--521028d2-c83b-4501-8498-937f2a38d263", "sighting_of_ref": "indicator--c1827c44-d62b-4662-91e6-c83e4247a035", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b3d42d5-5113-400f-bd20-24840971fc32", "sighting_of_ref": "indicator--f738fc77-44b6-4e74-8135-5739d650426e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66febe70-e7ea-4c8b-93e7-2e99d152d6ef", "sighting_of_ref": "indicator--e060d6ce-d0e0-4870-82bb-46af8707774a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f06de4de-36dc-4779-9e84-a8b333a1e991", "sighting_of_ref": "indicator--7ebe00a2-c09b-4160-a7fa-19f97644adc1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2d82200-97a1-4dfb-8ae3-20449fdbf3ee", "sighting_of_ref": "indicator--1417a48d-39b8-493a-9114-05b4daa88f8f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a959004e-57f1-442f-90ac-3a747c6b5d05", "sighting_of_ref": "indicator--99d7bae6-0399-4b28-b9d4-445c3d8f7852", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0f28f37-7211-4592-9d6a-26dc16914136", "sighting_of_ref": "indicator--2cfdb714-83ca-4a75-9ec4-471c7988aa92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--314fd424-a2e6-466e-b6b0-c6f3d4a040f2", "sighting_of_ref": "indicator--1d1c43c7-c62a-4ce7-a91e-94f460544225", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8b1fc84-d585-4112-ae7a-6c1e79cf3648", "sighting_of_ref": "indicator--53d0795d-b7aa-4763-95e3-0ada4714bfbd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--755d6767-b03a-4e2f-8aad-d25bb7fd3e18", "sighting_of_ref": "indicator--b172087f-8847-4a10-8077-066fb63488a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--732be193-70e4-4131-b191-4a72de633761", "sighting_of_ref": "indicator--63da1403-935d-412a-aae3-1cfb10c5054f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2a3ee0e-8cf9-4e6f-9795-a5d1d0ed3fbe", "sighting_of_ref": "indicator--ba2d5ad7-ceb0-4959-b442-461785d79081", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--305217b6-82e1-4fb9-9eb8-6760eb53fc99", "sighting_of_ref": "indicator--96b5a199-e3a4-4170-b17a-4142c122911f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f03de09-dccc-40bf-a382-ef2c1a40286e", "sighting_of_ref": "indicator--40cb7bfa-143a-466e-a3d2-1393dcf59fa4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e98bca67-f8c7-4a84-98fc-84f6a605bf21", "sighting_of_ref": "indicator--114fbb80-da32-4103-8aa2-d8c3e86b1d48", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3074f8c-3b10-4d4d-96c3-c60a83126941", "sighting_of_ref": "indicator--1e28aebd-5618-465a-bc2d-0a85190944d9", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e74cef9-5390-438e-ab05-3fc4ad5f38aa", "sighting_of_ref": "indicator--5bc1cc34-9a1f-4c58-82ce-d32be73648f3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc042490-1fa1-40bd-a437-50d6f911c9d3", "sighting_of_ref": "indicator--70f69b85-9d7f-4886-9cb8-58b6e59a2325", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78228628-258e-4b1a-9a33-330c9e80c4c3", "sighting_of_ref": "indicator--318b02f0-11bf-4b67-8089-4f7fad33d67b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--459f2268-8906-4f38-9a14-58c5d5b5dae1", "sighting_of_ref": "indicator--053cb58a-ebfb-43ee-af64-b9e41b1dedbc", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199088be-ebe5-48c5-8f95-33061eab106b", "sighting_of_ref": "indicator--eb477f8d-7d6b-4e59-a6f7-b920c6ab3d44", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cf56cfc-a363-4c64-9023-619673a166e1", "sighting_of_ref": "indicator--59c13477-78ed-4a6d-beb0-35362be1fc68", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fbba2c2-e8da-41c8-abc6-6e9737c0e194", "sighting_of_ref": "indicator--a15c0b51-8182-466f-a5a9-79e2d6914cc3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5446d20a-ee11-4a4b-a813-cdb0da404bdd", "sighting_of_ref": "indicator--9d3a1464-403f-4ae8-94cc-8450ef986f49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f8dd3d-aa0f-4ae5-acec-38d8c4580170", "sighting_of_ref": "indicator--2d4d2069-153e-46d3-ad84-e436404f2104", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b154d0e-0c2c-419c-83ef-b7e99b17f39b", "sighting_of_ref": "indicator--a9765245-0941-44c0-bf02-a1ae1ad9b17c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f27f16-65a3-4fd9-a47a-46e5d4d01d0c", "sighting_of_ref": "indicator--4d280688-aa0b-48ce-88c3-ad4599d7ef6b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32af472e-bb72-43ce-b3a6-4b4630361dfc", "sighting_of_ref": "indicator--18c03411-3580-4fe8-8add-21c555e3dbda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a2b6c1-9d19-47a5-b895-26340fcce9de", "sighting_of_ref": "indicator--b13e89ea-e9ed-45d0-a9b2-008494f4cb4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f358d7-3031-4fd6-a04f-beebe0e7967b", "sighting_of_ref": "indicator--e5c85990-3102-4aa3-9a84-22583359cd66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53b2e659-7ffa-464e-8b92-8523c8f1195f", "sighting_of_ref": "indicator--ac2f83e4-be8a-48cd-a38e-ed961cf4231a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff7894b1-1fbf-43ab-b120-a650bd64e9ad", "sighting_of_ref": "indicator--5eb89606-d902-43a0-849a-0f64755009b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f0aace8-8fba-4f85-8dd3-dc1951736240", "sighting_of_ref": "indicator--bc98e37d-6a2c-46ed-af5d-be10cb11da46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91fa7c2f-b1fe-4f56-96ab-f41353580786", "sighting_of_ref": "indicator--16dbf4c8-ba65-4f75-9fe6-84ba905a2c45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96a65aba-b054-437e-8782-79a18683df9c", "sighting_of_ref": "indicator--ea84f678-d87e-4fdd-ae0d-07343684d32b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf93d236-c1bc-49f7-9466-31529003d773", "sighting_of_ref": "indicator--663026de-0168-4810-b0bb-6c655d13188d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935a24bb-04ce-45e3-a8b8-7dfaa0b5b098", "sighting_of_ref": "indicator--d14ace10-935a-4b2a-88d2-69d9313d48ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5af9a114-2abf-4c21-899e-fcaea3326ade", "sighting_of_ref": "indicator--b35e5896-91e5-4b26-82b4-9632e6a0a10e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f701d5f9-a653-4660-b012-c040d6cd0228", "sighting_of_ref": "indicator--4b4aab2d-0032-448e-b598-d356ca1db3b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8442a625-633b-4048-ac0f-7d0b22e5f7e0", "sighting_of_ref": "indicator--063d7492-d645-4392-824e-e838d23fb5c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117f37ae-c739-4c23-8a7a-01d84002e15a", "sighting_of_ref": "indicator--679e6fcb-1102-488e-baf3-c88b83bd4d6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95b99584-a3b0-4e82-b555-55b921ec62c5", "sighting_of_ref": "indicator--0529c063-9171-4258-9fd3-7f7783f84331", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49be80a0-463d-4125-9a14-3b989b425362", "sighting_of_ref": "indicator--b93ccb92-98f8-42fc-810d-22f1eb1b100b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9a72d8-97ca-4916-9cc9-2c94f96be5c4", "sighting_of_ref": "indicator--e47a981b-0ef9-4720-9411-1f435100e3b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--414bf8e6-d559-4e3b-89f2-fd0c87c802d3", "sighting_of_ref": "indicator--c89a3736-1d48-4949-b38a-b74a67a6e079", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935aac35-4bcf-4f8a-91c3-6c5fe691b60a", "sighting_of_ref": "indicator--cf0b1f0c-430b-422e-9bd7-0ab19dccd435", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ecb25e-84c3-4694-829e-14e70bb98205", "sighting_of_ref": "indicator--e3bb26d4-908a-4fd3-b6ec-def01acb4657", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75019834-bcb0-40aa-a5da-daddf45fffcf", "sighting_of_ref": "indicator--85beefde-0bd6-4af5-b03f-e2b9f6bf8271", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8096bee6-815c-4bca-8141-1aaf3816f65e", "sighting_of_ref": "indicator--8e0f1b9d-c9a9-4bf6-971b-4566371081ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e33854-e0b7-4727-9ac1-d4cf6be3d2fc", "sighting_of_ref": "indicator--08251877-3160-4afd-bdaf-4f5b5f4d8dab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4958b7dc-ee14-47d6-b8fb-dbd999c605ce", "sighting_of_ref": "indicator--80792d65-bd11-4cd8-8e58-773d7781b884", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd211008-77f3-46a0-bcc9-ff03085c224b", "sighting_of_ref": "indicator--2fb8b0b4-369d-4094-9a59-7a2a48d9efea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a8acd39-9d77-4ac4-8196-57dcf7b6e479", "sighting_of_ref": "indicator--47fb948f-7f7e-401c-b3df-93b1960ae139", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a8f5d6c-5782-462e-b340-f9235df6b76e", "sighting_of_ref": "indicator--08c9a934-4dee-448d-b24c-8600657028a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67e63b80-4efe-453f-98ae-d9a2f392833b", "sighting_of_ref": "indicator--088935c8-2d78-4727-8061-06c96f96edbb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67cea329-2103-4492-af28-387199767a59", "sighting_of_ref": "indicator--69211e51-c41f-4945-8538-b1f4640930b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa60f947-81c9-4e9e-bcd8-957690422770", "sighting_of_ref": "indicator--9ac4abde-dcf2-4817-8170-74bc3bd1e488", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e5db33-2eae-44da-aeea-2dd831518d14", "sighting_of_ref": "indicator--a812f1dc-a0f2-47fc-a003-253c6515134c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c82eeff-2680-4014-8802-e8519607fe7f", "sighting_of_ref": "indicator--8d3799cf-0084-4d5b-943e-8e3f301ce6d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbe5a2e-6103-4263-9cf8-ce925d5b0e1c", "sighting_of_ref": "indicator--492bff5f-847c-41a9-bd9c-ed89e621a976", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1466d0b-3f2f-4190-a411-4d2e3de1e496", "sighting_of_ref": "indicator--4878620b-2e5a-4ea9-aee1-c8f15f74bfb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91cc76f6-dbed-4c98-960f-c258ae187e36", "sighting_of_ref": "indicator--18fb95cb-f084-40ce-9a83-99e526881beb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8dfb9e-ee65-495f-a66a-e251289ab824", "sighting_of_ref": "indicator--6c353db9-8e8c-482c-86db-a9f4198de778", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcb8c756-0810-4de2-801a-d3f8bc67c980", "sighting_of_ref": "indicator--554434b0-6212-4483-8f2a-0ab655219416", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddaf85bb-eb8c-4665-95de-e733cacdcdc3", "sighting_of_ref": "indicator--75669c95-14f8-4299-83a4-85a30d0c8c2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b41c6db5-8d69-49cd-80e2-289e990918d6", "sighting_of_ref": "indicator--91d8c69a-a2d7-439c-a7ad-e1da249b7a0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74c3f2e4-8751-4466-834f-b31c197b293e", "sighting_of_ref": "indicator--237b6c70-14a0-46ae-bf3d-538f8eae9f97", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--461e0a07-b13a-478d-8ae2-b61a67d7f577", "sighting_of_ref": "indicator--9725b27f-8839-43fb-ae40-88a2e87dec19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--079db474-dc81-4c4b-840b-99e167e0fbdd", "sighting_of_ref": "indicator--66308229-ea97-483c-8436-927627d1b6ad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b5aee2b-7b45-435b-a513-c32beb6865e7", "sighting_of_ref": "indicator--2a128b98-93f7-470f-bb7c-46d5795624e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28deddde-8cd5-4bae-8330-43c19e45cebb", "sighting_of_ref": "indicator--8817d205-d67f-4cfd-a2e0-690d3118bbd4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f99047-1490-4888-9f5d-7bc3a457eb77", "sighting_of_ref": "indicator--d8e19ff9-ec32-4c89-9b11-6c2bfefd7494", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d457171-dc5a-4132-8bc4-c0dc4643dd21", "sighting_of_ref": "indicator--939e6c65-1901-445b-9251-2b5b0b656a02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218a1361-8f8f-4bc5-b518-89d370e7da45", "sighting_of_ref": "indicator--49d9594a-b41c-4d1b-aeb8-7b8c279a821c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf67531-cf24-45ed-90b9-0145254e40e5", "sighting_of_ref": "indicator--94b22b93-80ac-4dbe-92fa-1c1688022cb1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dad2fe0-e986-459e-9c5d-b7920ce44004", "sighting_of_ref": "indicator--a1b7279e-0f26-4e29-9611-d1d83c2d831b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38bc1f0e-3b86-459a-aec9-a7ffde879266", "sighting_of_ref": "indicator--c78871df-8a5e-4271-9b48-c779d58d1252", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2322cb-53df-4f6c-93b4-4c4d7bd74cac", "sighting_of_ref": "indicator--d5db0f78-6441-476a-ad90-a4431ff5a529", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b30962a9-e193-4908-b165-32d8c3356cba", "sighting_of_ref": "indicator--970e320a-54e0-4190-afad-73b5c3ce648b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd6c9715-ec4b-444e-b420-ccb51c5d68e7", "sighting_of_ref": "indicator--7ea683d5-5e45-4b7c-a4cb-404eb6f19fc9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7535d50-044f-4c0e-b3d7-8da56f466a0b", "sighting_of_ref": "indicator--91ce2e09-d062-421d-8907-072880d58ce7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67cad7a8-e146-4f7d-a048-99b08f61202e", "sighting_of_ref": "indicator--5b6c6dcd-9f6c-4c00-ac77-4768b178db22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73a0c1c6-0503-4705-a7ff-7355a0033c99", "sighting_of_ref": "indicator--cf816106-766d-4d52-8dda-67483570a2e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--504c14cb-275f-4ff8-b6ce-7fb44a957607", "sighting_of_ref": "indicator--6627a7da-5427-49bc-a685-28366c219896", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b265b9e0-67a3-42c2-a56c-7f9bf0693330", "sighting_of_ref": "indicator--e94e79b6-ff93-4569-9649-40cf198e6fff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48d4bc5-f0fd-4ede-9222-abf2b8385cf7", "sighting_of_ref": "indicator--e7361804-15ef-48e9-b567-4ea6fc8a45d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67e83c9d-1672-464a-8832-1dcea7b149e6", "sighting_of_ref": "indicator--e92d145c-72bd-45be-a18e-ede773cbd1a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d0f7b8-3c6e-4dfe-b6f4-ab130d57f29f", "sighting_of_ref": "indicator--0e373f46-f4ff-430c-9d0d-562950a7ceae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b48b7b88-b06a-49f1-a68e-40169c03fb69", "sighting_of_ref": "indicator--4cfff31f-fcea-46d4-a2d5-0577e744adff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34531a4f-bb09-4d04-ad27-e788f2284787", "sighting_of_ref": "indicator--921e8bfb-cabd-4472-a53c-75e96eadb9ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9529c632-8491-4218-af71-e1547bd738a2", "sighting_of_ref": "indicator--ec90014f-c3a5-4a9c-a035-31d5dc85ddc8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b608c5a8-8c05-4b25-a7b0-329dd4006801", "sighting_of_ref": "indicator--52f35cb3-c480-4066-a70f-bf8f2117ff54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81b2ee0-028b-4b32-8e22-0a2083c0e779", "sighting_of_ref": "indicator--474d0997-55b3-4fee-8c06-a51c6530714a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9ca8a6-fc10-4f96-b010-87cb03b48a95", "sighting_of_ref": "indicator--efd215fa-6ed0-4947-9398-ae09d9765cd8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c28a71b-3866-4810-9e49-f96924c06a92", "sighting_of_ref": "indicator--9574797d-02cf-4ede-b85a-89548e2bade2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f0992ed-a314-4a15-ad07-4815aa3917cf", "sighting_of_ref": "indicator--4371a98c-a105-4751-8f69-3a5f6f6fe1f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199cace0-5cba-4916-88b2-5817b493c6fb", "sighting_of_ref": "indicator--5387f377-5b77-4d6b-b2ad-24f0cd34ef6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d00906ca-f273-48e0-aa68-04dac05f1cfd", "sighting_of_ref": "indicator--32c2d106-4b09-4779-9582-01a826906bf6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--973b19ac-68c7-4400-86ac-8c862697d625", "sighting_of_ref": "indicator--2a967ec9-a365-4ef2-a3d4-df21c09b11ad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89d53da2-a500-4736-b662-d17775013adc", "sighting_of_ref": "indicator--07095547-99dc-4b68-a493-4f194a633427", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eec486c1-7e0c-4ada-b671-f3bda07a0b9b", "sighting_of_ref": "indicator--5091dc7d-161a-4fbc-9441-0ba8f95320bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e54d0a-0c23-4cdb-8072-c17d08eaaf35", "sighting_of_ref": "indicator--b7118ff8-4dc3-48ac-b9c4-5df5fdb63837", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50f2eea-b802-4d63-83bd-d1ed2eac2cb8", "sighting_of_ref": "indicator--a56f97b8-fac0-48e7-922e-eb344a23dc54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3670389d-c017-4e40-908d-5cbe80ab918f", "sighting_of_ref": "indicator--8d58d9da-1ed5-45da-9363-cc2327abca33", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fbdf7cb-f571-4ab5-9232-17bfa5ff80a5", "sighting_of_ref": "indicator--54193180-b290-45a4-855d-67097d9dc143", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cadd50d0-c44d-4467-aa52-d1d162d6c29c", "sighting_of_ref": "indicator--bcf9af7c-d52a-47e1-bfbf-6269a5c2cc2c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b82b81b0-d96c-4ede-b5d4-04c1bc1f1803", "sighting_of_ref": "indicator--63f08cf9-8965-4a87-ab21-e61c429f27c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--997a5eef-b979-4c42-b100-2302eeb6e5e6", "sighting_of_ref": "indicator--ba2b4556-7a78-49eb-a941-762bf48de944", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2db3baa6-bd38-46f9-a3a0-275e2138be54", "sighting_of_ref": "indicator--4b75d444-e661-4e75-9248-27d984f7dfe9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1b512f-0c92-4d27-ad9e-82e46373379b", "sighting_of_ref": "indicator--f8dc0ac5-85fe-47b2-92d9-a06317be7b8f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e986834-b9c5-43b3-a73f-6fbcb825b3bc", "sighting_of_ref": "indicator--cd5076df-bddb-4320-bd33-96840c8d1b0f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b5c8f70-639f-4f01-9fc0-01d064b78fb6", "sighting_of_ref": "indicator--7d2b6d15-34c3-43df-ab48-86632e19a1aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cba0494-ea2c-4c6e-8e29-0ebd4d7ea156", "sighting_of_ref": "indicator--27104ac4-e66a-4df9-a374-7c28454abdda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b691a4-42e2-47bd-be8e-a6d864e0e0c4", "sighting_of_ref": "indicator--dcdbd6b9-2da8-44ff-8b83-04127aaa5927", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2203336a-ea61-40a2-b4ee-6d738f11e199", "sighting_of_ref": "indicator--15494ba0-de8a-466a-b0f0-7ea941d9ca75", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5daa1935-1b75-4126-96e9-7d831a1b1df8", "sighting_of_ref": "indicator--50faa63f-b8ae-4977-9d9b-7a924e3060db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4b04366-b3a1-466a-8011-2418af770729", "sighting_of_ref": "indicator--34e582cb-ff8a-46e7-84ad-983eec7dc49a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b4984c7-24d0-494d-a5c6-b1faa859b405", "sighting_of_ref": "indicator--9f940554-ab57-40cc-853f-7343e7ff3399", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c4ee29-38d0-4d5e-b654-4987f9af25dd", "sighting_of_ref": "indicator--5a815999-c247-48c4-83a0-c0d1bce5dbe4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--630d49f6-0436-405a-b509-81068a5a46a5", "sighting_of_ref": "indicator--78ffb079-ea43-433e-99d7-173680f246e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8ade879-7c1b-402f-9592-97e3bfd1e01f", "sighting_of_ref": "indicator--3d79495c-f314-4561-b849-0b4c5bc74fe3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58ea048d-0d88-4670-ac32-597df6eb053f", "sighting_of_ref": "indicator--c82ca90f-675c-4713-8e7c-0d73adc122b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86231a12-2827-4750-afa5-287d2fb7450d", "sighting_of_ref": "indicator--81bb6f7e-6078-4f28-9342-68239cc338f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb64e600-1a83-4e06-aa89-4366305d3ac1", "sighting_of_ref": "indicator--9667b587-f3f0-4e82-9526-1babfab70925", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1316019c-7ec2-4a7e-84cb-9972ac9870cb", "sighting_of_ref": "indicator--91f85213-dbec-4c55-976b-1bcd9a4adeae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10eab315-077d-4c54-92f2-8d6c8f49fbc5", "sighting_of_ref": "indicator--2c4a9d65-238b-4380-a47d-ba819d5668a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b998604-9a7b-47fd-b5c9-f5798852212b", "sighting_of_ref": "indicator--e4063b88-b178-4617-9125-9b3d821725c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d37a7eea-828e-4e46-a214-25a7726fc3de", "sighting_of_ref": "indicator--8501491b-7e72-4f3f-932a-b9447d517a7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674863ae-7c15-4d99-aeba-c65cb03d77e1", "sighting_of_ref": "indicator--adb35488-666b-4717-b488-7fd1159eb114", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfd0deaf-d2f4-4972-bf01-602e915f8762", "sighting_of_ref": "indicator--700dae45-da31-4719-aeea-fd1e18f23cfc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb159fe-52bd-49f0-9415-f2c74c48cfb4", "sighting_of_ref": "indicator--fd49fc7a-d96a-4257-9c8c-928bd546d356", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f2c224-6d36-41ab-a889-1d8dc42f3dd7", "sighting_of_ref": "indicator--3b924dc8-49a5-4644-a283-c8c9fba22380", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bb24525-b539-4673-83c2-5d6aa2aa46bb", "sighting_of_ref": "indicator--ce011ba8-9cc2-4b13-9555-0e4bc4c1779f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c482f7f-f34d-4b9d-a87d-81f1c83b8514", "sighting_of_ref": "indicator--308fd7d2-36f9-46ce-b66b-36348954078f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d3b5d3-86e6-4f0f-b7a6-a8aa07644a78", "sighting_of_ref": "indicator--9fb13314-3b63-46ed-ba7e-3c0b973792ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--682eedee-b41e-4c74-93c4-465381d15527", "sighting_of_ref": "indicator--5a591082-ca5c-44d2-8fc6-5c60a4db48d2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb78c20-1510-41c3-a820-513332a2ddcf", "sighting_of_ref": "indicator--b83eabce-888a-4381-b199-14253092418d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94b98557-da2a-47fd-80c3-65fa2d691bba", "sighting_of_ref": "indicator--5af34cb2-e87c-4658-9508-7c77b8bec18b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdfa08a1-cea2-44f3-b866-edab59f00ef4", "sighting_of_ref": "indicator--92afa932-b174-4c22-b94e-75c8150f61eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ea99833-e6a2-49af-aa75-87e38fac0cc1", "sighting_of_ref": "indicator--d0fbc85e-57b2-4639-9930-88486a91cfd7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3fdf2f9-c05c-49c0-8dbe-51004c6a8c6f", "sighting_of_ref": "indicator--e005252e-f4d1-4fdb-8cc6-e21286478072", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6c7344-4077-47ed-9366-e77182732b0f", "sighting_of_ref": "indicator--9652fdda-e789-4609-8f35-c943ca29b38e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de4e93d6-6614-478b-9227-cfb208773d9a", "sighting_of_ref": "indicator--8832b80f-9c64-4158-8875-98e212b40174", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0efb96c-e231-4620-88ef-2cb4fa9f3341", "sighting_of_ref": "indicator--7e02c676-765c-44bf-838a-9643665f4d9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0dac6b5-17d1-4369-baff-6306555928fa", "sighting_of_ref": "indicator--957d1d1c-e461-4cbe-a613-ee9e09074b72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af25f033-90e6-45ad-8ae4-5fb864106aa0", "sighting_of_ref": "indicator--513900a1-ffa1-45ae-a52f-0bbc9bda3011", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c39a29d-cd16-4754-ac7d-c7635752220e", "sighting_of_ref": "indicator--da57c663-66ba-4b37-8bb9-26e76a8e3871", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbf30ca0-ffbb-43ac-88a6-3ca845609abc", "sighting_of_ref": "indicator--08253901-ef78-4278-8fe6-9c66f011a47e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76594acb-eb81-4717-b10f-7c93351f4d4e", "sighting_of_ref": "indicator--fc3e4bb0-da78-4b2a-9f5b-1e3d80ffa082", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b564698-2720-4d5a-96e0-393c06d1e488", "sighting_of_ref": "indicator--34a795a1-ead6-4ae1-973c-e40f7e5b139a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68cfa389-fdea-49c3-b243-3cfacb195cf4", "sighting_of_ref": "indicator--b6ed75d2-c053-4e97-9c95-ba758bb65936", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90ab4fa-bada-49cb-a466-c3e65e31f008", "sighting_of_ref": "indicator--9f602e03-129c-42eb-8759-56c2a81712d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10e49fe-0d01-4fbc-9679-f0156ad741c6", "sighting_of_ref": "indicator--dccadca1-436f-4076-8be1-5fac8b90c661", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--665be6a9-3c74-4739-a701-72da5f6a3d30", "sighting_of_ref": "indicator--5204d3bb-1c28-466b-80ea-2818fe6852ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35b3569d-074c-4a68-a130-4e14deb469cb", "sighting_of_ref": "indicator--2c42ccdf-eadd-40f3-b7bb-eb9285b4faac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d363b2-310d-456b-965a-02458c33310f", "sighting_of_ref": "indicator--291203f2-02da-40f7-8a54-7e3b17a52e9f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c824c38-76b4-4e15-b9c3-760e7417993a", "sighting_of_ref": "indicator--57f6e17b-c935-41d8-9a22-0031f10ceefd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a383d843-7d58-43ce-be58-888bae451d0f", "sighting_of_ref": "indicator--0eff81bb-89bf-4db2-8c1b-25d547385e78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad74f9c8-9560-42b4-b132-ec030645cbdb", "sighting_of_ref": "indicator--a7454428-5579-4ce8-8395-9172187f9dea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a45b78-0d6d-4b3d-ac1e-6a995feb8a87", "sighting_of_ref": "indicator--27c6a5f2-fa0f-41a5-9fb3-c823d3246abd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b58c2a6-30d1-4734-80b1-865a9beb13a4", "sighting_of_ref": "indicator--ec07c641-e2ea-40e7-8289-e53e2eb6b6ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e6b3070-611d-4e2a-a37d-5cc0714e8d13", "sighting_of_ref": "indicator--bd0cd65c-86d0-4ec9-af48-0c611dcdf739", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809a2c47-fd31-4dfc-99de-46e1a2f58787", "sighting_of_ref": "indicator--be3fc36e-03dd-4baa-a336-aa99cc11f65c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--573c9cf4-d401-4ba8-b01a-83dc08e4220c", "sighting_of_ref": "indicator--651c7a9e-525e-4bff-8982-9e3c8b786b30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cefee655-1a5b-4ac7-b6b4-c5d37d8f608d", "sighting_of_ref": "indicator--779c8568-d5e6-4257-b260-732feb076dfa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49de53f1-c171-479c-84a9-331a1b94adc4", "sighting_of_ref": "indicator--d3415618-fea0-4c6f-9c81-bfd76382205a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbffb699-66bf-4f1d-a790-70c324d20f33", "sighting_of_ref": "indicator--419a4e76-3e7b-4673-a966-ba66e3009882", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2aa019-2528-4308-9d44-635d6c11671e", "sighting_of_ref": "indicator--31627d30-201a-4c38-8ecd-a5ab62f9cbc6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd7fe30-b417-419d-b754-4203e61573e3", "sighting_of_ref": "indicator--803d9a35-4818-4372-91ec-facea029da6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc0640fa-8f76-4f6c-a226-283bc696efbe", "sighting_of_ref": "indicator--5915ac9e-48c6-48d8-a02e-2ec573af9bbd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1d42a9-e828-4617-8bf6-f8f0ac88edbf", "sighting_of_ref": "indicator--f2f225d4-6645-4b65-a6c6-46bf8dd42a94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf580385-c777-435d-ae7d-9335caab5d7b", "sighting_of_ref": "indicator--35ebfa27-1381-438e-9b93-616d121e6f99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4f09434-0f8d-452a-81bd-d038f91534fb", "sighting_of_ref": "indicator--aab9c6f6-3f8e-4239-bc84-9672dad1e67e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--543ac312-5ce6-4912-bcf8-42456921c1b1", "sighting_of_ref": "indicator--296efee5-cdca-406a-a211-edee88f775a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78c4f333-6c9b-476c-a052-2b3cc4da9e3d", "sighting_of_ref": "indicator--54ff3165-f259-4fa1-b461-c131aabdc68f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca54ae2f-6917-4402-877a-5b0bd7e5ca41", "sighting_of_ref": "indicator--cfed9bbb-7c24-4d85-8c54-4fcd1b4d6469", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59e3eace-3f26-44da-8ea2-b3560a5bf1d5", "sighting_of_ref": "indicator--8c99d4af-cc6a-4dd5-8734-e12e7b41ff17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c001e18-18e7-4517-9057-f995d23371f1", "sighting_of_ref": "indicator--cdd3cd0f-ff2d-412e-9b6d-cf63b0e1d118", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb800658-37a9-46ce-a369-e4dfb0fff157", "sighting_of_ref": "indicator--d0a98bac-ad67-4d4d-b561-8c01e0618d44", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0b8b62c-f4a0-40a3-a3c6-36e11a1d4050", "sighting_of_ref": "indicator--94b5aa8a-e263-44aa-bdf9-79e95844e06c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fc29779-01cd-48cf-ad1d-621836c9e193", "sighting_of_ref": "indicator--86001c56-d7f7-4242-bb46-4cba2b2ecaeb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e04ed582-cafb-4f0c-87dd-52a95b1f76a4", "sighting_of_ref": "indicator--1b6ae1a7-f865-454f-abfc-69684a38c0ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd790242-a0f7-4f9d-be8c-f99dd00acfa2", "sighting_of_ref": "indicator--d5333d83-a377-4357-841a-13583659b120", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--529437d3-8cf5-48bc-a8c5-3ea190e8fc50", "sighting_of_ref": "indicator--50edcbbf-63d5-4822-8db9-ecbbe0687dca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--222b3e34-1795-4b33-a6a5-e9804fea04d0", "sighting_of_ref": "indicator--e8ace709-16b3-4c6d-9ab3-417c3e4ea0de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab7c4e3-61af-4cdb-9897-4e01e1de538b", "sighting_of_ref": "indicator--43b7f3b5-ae5e-4727-b401-4a8df5c6f667", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32fabc56-e781-47b9-8971-857cffaee324", "sighting_of_ref": "indicator--a4624e17-0573-4214-8585-0df54f3cc642", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58dca366-8c0b-4659-8926-76b08c244e52", "sighting_of_ref": "indicator--064d4fa1-162a-4f24-be6d-bf01522afbae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc819fb-78ee-41e7-89ca-607db015929b", "sighting_of_ref": "indicator--93f85c44-8d8b-41f4-a33e-d4545c24295c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac0020d3-f6c1-4855-8f05-a2c6fe8bf500", "sighting_of_ref": "indicator--b7e7679d-a17d-4779-b002-427ede85bdc3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e62bb97-6370-4169-8bca-fb850adb0073", "sighting_of_ref": "indicator--81c2bce1-0ce1-45e5-b2ef-be63a5071308", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a13601c-43e8-4281-b086-7c8db8b7644f", "sighting_of_ref": "indicator--18b5723d-00ee-487e-b5b9-71e11f8c43fa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b888fdb4-1487-4b4c-8cfe-448e3995dff5", "sighting_of_ref": "indicator--cae6d840-f4b8-44ba-beeb-7ebbb280998d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--858b38b3-2046-401c-bd12-d56a2f7397db", "sighting_of_ref": "indicator--62eacae7-1e5c-4f27-acd8-191712ca56d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cfb93cc-db99-402f-ad3b-67a7c3605f96", "sighting_of_ref": "indicator--002dfef7-84f4-46c6-87a5-30e1802da46b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bd79f49-2431-42fd-aabf-67b94e0d8926", "sighting_of_ref": "indicator--6a050021-8989-44cc-b658-0a70b79bd93e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1cf815e-c6c1-4b28-9763-6c1452a41484", "sighting_of_ref": "indicator--edda5aec-e0f2-411d-87b3-0ffaaff92ae6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f212032-1f13-40c4-9d90-fba60c5416a9", "sighting_of_ref": "indicator--57c2872a-ec50-44a7-85a5-20eea0159b4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516be4a4-b786-46e8-9e7c-b4e6298d6f2d", "sighting_of_ref": "indicator--eef3a22f-6002-43c0-b405-08945f07b8c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd196d5-3a5a-46d8-a5c1-ba6d3979f698", "sighting_of_ref": "indicator--b5ecf61a-3068-42a2-aa01-3959274c0b12", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edb423f-af2a-48cc-ad38-ce74083f8c1b", "sighting_of_ref": "indicator--a38a0603-30cf-43d7-8787-d3039445a0e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba9bbb3f-900c-4d31-ad89-b321228c540a", "sighting_of_ref": "indicator--6fbc872c-76ca-4d9b-8c2f-c53177d5c716", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862e356a-55af-43a9-85ee-a11f82f28bf8", "sighting_of_ref": "indicator--2fd407a9-9ad2-4190-ba02-33ee4e471006", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6529ead-b3b4-487e-9046-10bd118548b2", "sighting_of_ref": "indicator--9ed00b6a-1c1d-4311-acb5-ed5a22409f19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c1bc10-73bd-4e57-bf34-496e774e92ba", "sighting_of_ref": "indicator--a201f7a4-e43b-4ca9-8236-0f3724a4fe98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91baea10-8fc1-48b0-b75a-343f20f664b4", "sighting_of_ref": "indicator--8eb65f9d-efe2-4ad4-8988-fa0c7eba6a7c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdf00bb0-7e2b-4a07-bf16-3e110c6cb418", "sighting_of_ref": "indicator--61407d8b-2569-4f53-bde9-be4722812844", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--732c3171-0ccf-4714-83b3-f93d331671e6", "sighting_of_ref": "indicator--7ad3d069-85c0-45d9-8906-a90f9200baa0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1008c0a-be3c-4c4c-954c-a07928a75735", "sighting_of_ref": "indicator--e9533234-7fa7-4942-8ae7-b3e2bfbfbde0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64816a5c-a434-4344-b1bd-f907c35b676c", "sighting_of_ref": "indicator--5cbdbb42-fa80-495b-bee0-d9e753bbe57d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76058850-794c-4608-baaa-7404c3894f5b", "sighting_of_ref": "indicator--6575d3da-8c4b-46b3-827b-007046cf3abf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2c06e8d-2766-4ff3-b412-0ef925ca2e34", "sighting_of_ref": "indicator--3b534eee-9617-4fa0-a7cd-959c4f71e38e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa86448b-5e9c-4b3e-a6da-34a401ba2a5e", "sighting_of_ref": "indicator--6c0802dd-9dd3-4034-9be2-cbf475adccdc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fffa672-2be6-4a0d-af51-c9cfb643efa6", "sighting_of_ref": "indicator--4244591a-58ac-44de-849a-61203859d021", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0af3e7ac-6853-4428-b0b9-fbad4ec27d3a", "sighting_of_ref": "indicator--5584ea17-abcd-460f-bc18-e018aabc7439", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--789ce4a5-1bb4-40c1-9923-5507d9d9f80d", "sighting_of_ref": "indicator--f9160526-822b-41c0-b5b1-e15297c74c04", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--287e5008-0997-4269-bd48-168084f8b92d", "sighting_of_ref": "indicator--d3dccc6e-5796-4e24-8dbf-2bb214f967eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a771be0-3142-4ecc-8c3e-1279e38866e6", "sighting_of_ref": "indicator--c54d3188-9a3f-4ea8-84f1-d17e73ffdec4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b59ca9b-8553-4ea2-89e6-9b5ad6bb476b", "sighting_of_ref": "indicator--dc9f8bef-9fa4-4c50-ad3f-802a04d6ea1c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f279647-b3c6-42cb-9f13-987740158927", "sighting_of_ref": "indicator--e6bbc641-ffd9-4cf5-92ef-1f69d61414b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb267576-6dbf-40db-ac29-cc2944da91f0", "sighting_of_ref": "indicator--fab61874-572e-4797-8e72-6cc8886ad320", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ad4fe6-db87-42da-b547-8ba9fdd88c6c", "sighting_of_ref": "indicator--87729b82-fcf3-459c-ac55-cb2038f9ec56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de3daf6-a11d-442d-ab9e-a4c0180af2e7", "sighting_of_ref": "indicator--a99c2c1e-338a-4cbc-be26-fe4e90c92a82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73385399-42c5-4227-bff7-47fc97b4ee6e", "sighting_of_ref": "indicator--1c7fb0c2-87dd-4362-b998-23a30cb98e6f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca2e0ba-1b5d-4833-8494-020b439fcd88", "sighting_of_ref": "indicator--d3f4d21e-2589-4691-9714-5771d2d98900", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d95b52-1906-40ca-8347-24a29349cb8a", "sighting_of_ref": "indicator--b710e0f6-a17e-4098-a75a-7c7771659859", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417cb8b6-f376-4912-ae7e-1d643129775c", "sighting_of_ref": "indicator--b72b3777-a46f-4861-8849-06a98db09cad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d0d4e8-3100-4b11-ad73-7221f18aa183", "sighting_of_ref": "indicator--71fe5f4b-4ae8-4832-92d8-9665100b0a02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cd46613-b637-4ab4-a51a-f8d3c706c013", "sighting_of_ref": "indicator--45397d56-f4b5-4721-89b3-08609cc0bae3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d54006-5838-497c-9fce-56e8b57c30bc", "sighting_of_ref": "indicator--395e3d19-0b9a-4ccf-b476-6c878aba73e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d387b72-0c7a-4f3e-950d-435884ee2174", "sighting_of_ref": "indicator--78a9f292-ceaf-40cd-8605-fbfd09354061", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3003ddcf-b1d0-446a-89ef-49707f7c1711", "sighting_of_ref": "indicator--eeb838c3-4a2a-464f-924e-717caaa75ac0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7206b81b-808b-44ae-84d9-ef22078dc208", "sighting_of_ref": "indicator--3add87c7-1fe2-4802-8336-7f5196904e87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2e134da-09ed-4a06-a27f-4fdb0c43020b", "sighting_of_ref": "indicator--3add87c7-1fe2-4802-8336-7f5196904e87", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c384f1-312f-4b9e-8927-31e5b88fdeed", "sighting_of_ref": "indicator--6ab77467-780f-4429-b9ae-7be31932480d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2494d677-4fd1-4329-b57b-81129ebd90b7", "sighting_of_ref": "indicator--2b45a4f3-a3b0-45bb-8470-6f135cfc35d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c98901-2ab1-4eae-b0c6-bc59c6c74dd9", "sighting_of_ref": "indicator--ea6233ab-7960-41b8-bb51-907b1f3769b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b06dd103-17c0-4ab3-93ea-579da90be4ef", "sighting_of_ref": "indicator--b5c7d485-0c51-4ec8-a66a-76b15216b36c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f6b3d36-45db-447a-b864-e74ec224a829", "sighting_of_ref": "indicator--7e6c8886-96bb-40bc-9450-ae5d6651bd6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ea19ce0-d245-49c1-b9a1-966119bcd1bb", "sighting_of_ref": "indicator--521c685c-663d-4132-8cbc-f53151cb4ae1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaf0063e-708d-4600-ac10-27203e1add9e", "sighting_of_ref": "indicator--6305ab09-7223-4ea4-8bac-710994c77c5c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba8b098-b9e2-4ffc-94e8-23eb07663c1c", "sighting_of_ref": "indicator--3e04d898-0135-43ba-a6f1-0653b5025dd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bd5617c-ec26-40c0-8139-7a3a8cfcdb3d", "sighting_of_ref": "indicator--af3ef458-17f8-4188-8699-54f7b95b8a90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2033d31b-9b33-432a-b144-20a0d79bd830", "sighting_of_ref": "indicator--2515ae17-2475-481d-80ca-e39b153e340c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6925f566-195a-4821-abcc-fceea526a2c2", "sighting_of_ref": "indicator--99ecf5ea-0c7d-4485-aa30-d50d87d8efab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30315c70-5422-4285-ba17-176abc573c79", "sighting_of_ref": "indicator--49107313-d04f-45a1-a242-8b47c1c559d2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2da5d502-8cc1-40de-ae40-3fbe4cc43978", "sighting_of_ref": "indicator--ebd9138a-5b2d-40a2-a286-ec3701b4fd5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1817b3ee-ea5f-49a4-98ac-c2de5eb93210", "sighting_of_ref": "indicator--902ec467-4f5e-4bf2-81a0-242c4d7bc143", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17e00af3-ef68-4c84-aea9-e94dda9e9df9", "sighting_of_ref": "indicator--a8d94754-9b0e-44c3-8172-7d3205024e65", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--937c932b-eee4-4959-896b-71972931a691", "sighting_of_ref": "indicator--79a63fd3-8682-4314-a048-14275528fd5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd5dccdd-2a30-4cfa-925b-92143779ba43", "sighting_of_ref": "indicator--b230055e-1858-4e1d-be26-231804ae0874", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dadaa256-d8c4-4f64-9ab3-62671eeda924", "sighting_of_ref": "indicator--13cd20a3-803f-432c-a9f6-524b391ece17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64ab83bd-7866-47c6-8dab-2f0828a8e53d", "sighting_of_ref": "indicator--de01f2da-368f-4c7b-af0c-88db8420888c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4498d4ab-1057-4e60-a837-b90ea26c9d5d", "sighting_of_ref": "indicator--55689743-0552-41cb-8c34-468d2d6016d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab7cf05-1c6d-4d23-93c1-4d9d60d0dd1a", "sighting_of_ref": "indicator--5f01f58c-d9a2-4f0b-9205-5c261300337d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0be09e-cd74-45a8-921b-40d7e987c463", "sighting_of_ref": "indicator--5d106a3a-da00-405d-85ff-91108b71a96f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--478accd9-6e68-43a3-a821-84e2d3b910e7", "sighting_of_ref": "indicator--98104bbf-b34b-42ed-87e4-7bc664b11e5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbad8501-8de8-4af5-844f-97c9f224f3a7", "sighting_of_ref": "indicator--a7f44473-75a4-4e7f-9ef5-a3c7f10cada5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d862174-1162-429c-8a22-ae0163bab84f", "sighting_of_ref": "indicator--bef7d4c7-2b4b-419c-a9f8-7caf66588e22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb9615c-d35f-49b7-86e6-8c82c044ed5b", "sighting_of_ref": "indicator--c6f7e012-4ec8-4c73-ba04-8ac9012c3075", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f5ff9a-41ec-4de9-ba26-99847ab36397", "sighting_of_ref": "indicator--2bafa0bf-5662-448e-a121-df2824bcbfdb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a70debb0-6bc7-4d27-8c54-0caf7b0fa206", "sighting_of_ref": "indicator--ada51a8e-caf5-4985-ade3-dfa74847596e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e637eb0-b9a7-474c-8ebe-26fb8d07e27f", "sighting_of_ref": "indicator--fbb109e4-9e76-4a25-843b-060fcf2fde1d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc35089a-a077-4721-9cd8-638094b61020", "sighting_of_ref": "indicator--91d33a41-1090-41cd-ad61-d22302ce1ac5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--593e0d46-82cb-4bbd-981e-8417e619e442", "sighting_of_ref": "indicator--709fa3df-3ce3-412c-89db-3cc712fc91d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05fb8987-5748-4044-acbc-e7dfe433494b", "sighting_of_ref": "indicator--9e8563ed-d7ee-46f5-b141-dcffb85c7d4f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d79ae7c1-1a2f-4691-8444-0b20eab1bbde", "sighting_of_ref": "indicator--08981a98-364e-48c4-9ead-70bb42bd731a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b00fee1-b1ba-4a15-99b8-108fd5670ddc", "sighting_of_ref": "indicator--795d9aba-5772-4ccf-b678-950b933699df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--727ed17b-4caa-4cc1-bb95-887842537d79", "sighting_of_ref": "indicator--52feca0b-0fe0-49f9-b55c-587a7034ae92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ae64ef-efe8-4cfe-9ee3-aaaea8dfc06a", "sighting_of_ref": "indicator--9800e6a0-89b2-48c6-b355-e7008e972069", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8f0d633-896a-407d-8d7f-0c57c7ffa86c", "sighting_of_ref": "indicator--997e23ea-bd74-46f2-81f5-5f745c647784", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea2061de-df4d-4ae0-b8ce-51e289f58c6d", "sighting_of_ref": "indicator--3b3ec771-633c-4480-8906-7e2bca1107af", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c14ae457-e2ca-4013-86d8-8f1dfee3defe", "sighting_of_ref": "indicator--8ace53be-0cbc-42dc-8c7b-212184995f2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d312f84b-c504-48f1-ad3e-7939dbd667ba", "sighting_of_ref": "indicator--1f07e996-be74-4173-a0e9-b65c790f18b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e97ec7-b3e6-4362-8e0f-dcc60f96b608", "sighting_of_ref": "indicator--02024d6e-b503-4e39-b050-f79e8b7f44ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1257734-4a82-4fa6-96b0-ca806b2c685f", "sighting_of_ref": "indicator--837ddb68-fec1-48bc-9ad6-71c5ebbb6b7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dfe76a7-f814-47b8-8822-7c3fc357094d", "sighting_of_ref": "indicator--f37b6699-4ca7-46f7-842a-cf252bb6d2a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4c56e5-b362-4e23-be7a-e9a7368d9e81", "sighting_of_ref": "indicator--9ca28ce4-2075-4a49-ad18-313bccbd8218", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aea5d39-91c8-48fb-834b-68450c36b2ad", "sighting_of_ref": "indicator--89fc2756-514b-492e-868f-6bd2c94a9706", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d4dfbb-6de5-40d7-b7a2-b1c93970bcef", "sighting_of_ref": "indicator--2b145e2e-b092-4b18-850c-5ca2e5b6b9c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c928e8cb-67cd-4ecc-af2b-2c41b4ea5b07", "sighting_of_ref": "indicator--8fbee8f8-716b-42d9-8f69-ea19644d8770", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9651c72-2435-47a4-bb45-f9ebc06a0671", "sighting_of_ref": "indicator--bfc89710-6c34-41d2-b41a-cc49e1259b53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4078d4d8-1de8-40b6-901b-d694ee90a6cc", "sighting_of_ref": "indicator--8b0ed8b5-a127-494e-bcca-1878e01b4bd1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d0b3a1-c53c-4cc3-a1d7-e4d8837fb109", "sighting_of_ref": "indicator--f25c9f26-4705-4f8d-8b5e-2f432d6e0e66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3b7fbc-f8f1-4bd6-9d5f-f84924c612f0", "sighting_of_ref": "indicator--3b6b59db-e57d-4ce8-876e-00da0868fc75", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1b767df-c528-400a-9e84-01c9d9549da4", "sighting_of_ref": "indicator--bc6addec-a546-4316-b3f1-ea2c14156eec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e840dd4d-f439-4b00-ae12-0412ec9f6750", "sighting_of_ref": "indicator--bb6a7e6d-0fe9-4c75-8ded-9b3cdf86deeb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98cb1038-ff1d-44f6-a2fd-f85358935d2e", "sighting_of_ref": "indicator--62583c2c-368d-4e12-8d89-894e1e87a7ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea1a89c3-22f8-4682-a72f-335c5580204a", "sighting_of_ref": "indicator--041f7896-b0a1-4ae7-9760-864708537b09", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--864837ae-33a9-4118-8e08-5577b98f7089", "sighting_of_ref": "indicator--b14c2094-9cef-4dfc-9b44-8f9b2983c87e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d7c723-6e9b-4322-bee3-468cc38d2f46", "sighting_of_ref": "indicator--edaadc18-222b-4820-a234-41aad6f6300f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c2d9c9c-a876-4066-96dd-d55d2b73c9ad", "sighting_of_ref": "indicator--b9c5d95e-35b9-4f00-9228-079f6ae7ea8f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8039651c-1a1f-4251-8021-a9cf4276f2bf", "sighting_of_ref": "indicator--c0405438-1c68-4560-97f7-5b7e0720a82c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3640ef08-8567-4cda-84b9-531150b46b6b", "sighting_of_ref": "indicator--724b46f3-ce94-4058-9c6f-4e86b80453a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e72d96f-2bd0-418e-a5f0-460d9a504ef1", "sighting_of_ref": "indicator--f7510288-5436-483f-99c4-98a02ef5158d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4af57492-37fd-4aa5-9a3c-0edd4ef156e9", "sighting_of_ref": "indicator--159983c8-02f3-4fc0-804d-5e46a905f030", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19215401-3e31-46ab-a0e8-8e0453f4b4be", "sighting_of_ref": "indicator--12e11fe2-e494-43c5-ba85-3c6c7e867bb1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1451ac3f-26c8-499f-80e6-5e4c1fa3929f", "sighting_of_ref": "indicator--b9bd2a09-f737-4746-bfa3-dd755c635caf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8645c90-a9e9-4f4d-81c5-c4fa85e92291", "sighting_of_ref": "indicator--c7887ae7-b544-47a7-bd2e-f0988c13c4de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea9be0d3-604d-41e0-9f93-f06272998e0f", "sighting_of_ref": "indicator--da962ebd-fc2e-4c4a-8395-c44cf837e7c3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962299ad-a48c-4ac3-bdb0-04babb96761e", "sighting_of_ref": "indicator--4b97ee1c-59c2-4811-a947-bbb1389b9979", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb260022-a2f5-468d-996a-da96a1b5be34", "sighting_of_ref": "indicator--e3625031-6003-4e4f-bf39-4c5a0e91663b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca256afd-59cb-4473-ab57-aa177128f9bb", "sighting_of_ref": "indicator--45c5706d-19c2-47b6-8322-4a557e1ca1f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65112db1-7e84-4c0d-9c0e-a9ec6d791646", "sighting_of_ref": "indicator--8b11e709-4ca0-4552-8bea-d99f5a754ae8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ab3b497-ee16-4a70-a60b-fe8429c0e272", "sighting_of_ref": "indicator--362928cc-39c1-45a9-abae-5ca2ad2d0b95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5aaec3d-c6c4-429e-8c88-4353d0616f6e", "sighting_of_ref": "indicator--e9824177-684b-42a9-a66f-ead660407e56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c55ad570-e746-46b2-a920-c050eb651407", "sighting_of_ref": "indicator--18425b44-3e4e-4653-80e0-aa66674a10b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef174ac1-a11e-442d-9cb7-8871fa392d69", "sighting_of_ref": "indicator--7c71a752-0138-42cf-bee5-2411b869707c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--176158f7-9cb1-4a49-8731-0a2fc06901be", "sighting_of_ref": "indicator--d319a31c-170d-450c-bc05-8ca71d1528c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec449432-07d0-408e-a050-a1dc5f40b659", "sighting_of_ref": "indicator--9c7a483f-60ab-4ccc-9b0c-cb9fb950e60c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--422e223b-2671-4190-9ddc-05e1b8bb42d6", "sighting_of_ref": "indicator--0c693507-1378-4b79-8586-b1bed2b93eb1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2756918b-fc9b-4ab2-824f-c3f461d95007", "sighting_of_ref": "indicator--053c8d4b-624a-4a67-a066-0bc0016f5047", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--733bac92-58b2-46fc-bfaf-19e76bed0c93", "sighting_of_ref": "indicator--c734c3c9-8def-4676-9d20-f23506f86202", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d651589a-71d1-4152-8fc3-8743935f152a", "sighting_of_ref": "indicator--f28e913f-1dd6-4004-9348-1c7e34922e54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8465e7a7-11eb-42bf-9f4c-0380db99a1b5", "sighting_of_ref": "indicator--68610741-7928-406c-a977-357ca1475d48", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92957248-8522-4265-b9dd-e2cc60f28a89", "sighting_of_ref": "indicator--1276648a-e5a7-4118-b0b7-bb408dd91d9a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293f073c-015c-4cfc-92fd-0c27a04e1d7c", "sighting_of_ref": "indicator--47f0e14d-de74-45c1-9b6b-4e1053cb5453", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44344255-b22f-4c39-8e1d-e8dbcb3a67ff", "sighting_of_ref": "indicator--32cd08ef-907d-4953-bbdf-2d3019391f81", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8a12eb9-4c17-4a09-a3d6-5d38abb32ed3", "sighting_of_ref": "indicator--02526221-6953-46b1-a8b4-a46520d4e1f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8668f91d-9d88-44f1-90b1-be09a0b159a8", "sighting_of_ref": "indicator--efc1d7cb-2c99-44b4-ae04-bc7fb3f465f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c22c46-c4f2-4893-a059-a07ab22ffb8a", "sighting_of_ref": "indicator--0e27c742-9b5f-4411-92d4-c38395b224f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7168f4c-c067-417e-898f-6c483b0f1005", "sighting_of_ref": "indicator--2239bc4a-9365-497c-a263-d0a35360410d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ecd8b92-825c-4be7-97c5-45112e9fb95c", "sighting_of_ref": "indicator--5a5dd8d1-38df-47f4-9c5c-5c96fee3507c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a479a4a-20f0-4d1d-a2c4-9e55d1a07478", "sighting_of_ref": "indicator--9de20e70-d8f6-4daf-9050-1085f5144f81", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74973e46-396e-4fe5-9d97-c884a541fa56", "sighting_of_ref": "indicator--08f2f37d-2e6b-4500-ae44-64c432374932", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--435ae207-7d5a-45da-8a17-8cf841ef5622", "sighting_of_ref": "indicator--7c8d9a58-cf9b-485e-93af-09a708b95403", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31210de-a8fa-4e64-a64d-b22a71f9d2c1", "sighting_of_ref": "indicator--66ffb6b7-e9c3-4c24-88df-37c717317bd4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a88faa-ab98-4e9a-b415-f6aecce14755", "sighting_of_ref": "indicator--41b3d603-0d65-4cbb-a838-52569c1a6baa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f1dda7a-b118-4e2c-98d5-d4452e7deb67", "sighting_of_ref": "indicator--a1db8dfb-c423-461a-9a49-8216020464f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7e11a14-db26-4e39-bfb9-ef22aa6c8cb3", "sighting_of_ref": "indicator--f38641e3-f16e-4cb8-89e3-82fbff1fa265", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aaf52ef-d470-493f-b06e-66d152fd2a42", "sighting_of_ref": "indicator--02f73420-781d-4db2-a95d-ba28df8a12df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df2665a-076d-443c-8755-955dab027818", "sighting_of_ref": "indicator--341bf7b0-43da-4d5b-846c-f3233baec632", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60268dca-9037-47e6-be3f-0f3c6d65a187", "sighting_of_ref": "indicator--d5c77333-be77-4625-ab2c-4b262d8cc3a8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc89a30-a081-450b-9f11-d7931208aa36", "sighting_of_ref": "indicator--a0d2655f-fac7-46db-b832-51c8fe7d7bd4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29a27f1e-75ab-4d99-b6e2-0bf1c39215e7", "sighting_of_ref": "indicator--2f142614-8cde-44b5-bf5c-451e36165fd5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7e7fa0-763a-4b4b-aceb-176549d1b1ab", "sighting_of_ref": "indicator--6d06d348-7d07-44c6-b431-a9cb75c2a869", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90e6dcae-d004-44a8-a255-0870cce56f61", "sighting_of_ref": "indicator--1c1fb170-3841-40a2-bc3d-28796ca5c872", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580054c7-a522-42c1-90b5-7301b09da0d4", "sighting_of_ref": "indicator--c347a5c6-aefb-4829-a3e1-40fd0cebc931", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0ca3c5d-ea49-4340-9db6-054aa090e890", "sighting_of_ref": "indicator--5766d46c-66ac-4ff3-857e-e5bc48034dec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0afe5e36-a56a-40fc-9425-dbee97e63754", "sighting_of_ref": "indicator--cb386ffb-a41a-47f7-951c-e20ddb81aec9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed9caff1-407c-4742-b8be-44f1854907c6", "sighting_of_ref": "indicator--2f688869-8ada-4ed7-90c9-61296afb55aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad9f2136-40fd-4dc2-8a3e-032fd700eb30", "sighting_of_ref": "indicator--6f23cfc0-ffb0-47e5-a131-a991862d499a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30a4a008-c7e5-4f19-8416-9b7582a8bddb", "sighting_of_ref": "indicator--98b2c8b1-5dcf-450e-b86f-d390767db2eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29ffbdac-bd26-4562-91c1-7b5f4609192f", "sighting_of_ref": "indicator--cc48388e-6618-4524-b2cc-3dbf3c119697", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d56d3cf7-d77f-4c2b-957d-e96e20648fe4", "sighting_of_ref": "indicator--d9da6142-4026-43a3-b08a-a12e8f47a67d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1e8d6d9-1aa0-4c07-a454-47bcb83fb352", "sighting_of_ref": "indicator--243b7000-13eb-4f86-b4e2-f24f0373e79b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4882eb93-64c5-4e32-be52-3fb1d3761d2f", "sighting_of_ref": "indicator--26870fac-2288-483f-8792-9f768cd37b4f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c47355-6f74-4358-9992-190ab9181200", "sighting_of_ref": "indicator--be6373bc-3a4c-4e08-b292-75ebf32d284e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad7f098-deb5-41e4-a835-7dd049c5ea20", "sighting_of_ref": "indicator--f5c91140-d8c8-4a54-a3f1-c5867579e255", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed2afdc1-b35b-4103-81a2-d5fa042c6a37", "sighting_of_ref": "indicator--2006e41f-fb03-4bca-9d85-174d4719db85", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f5e7838-7816-46a8-a4fa-7eb2a3a79ee1", "sighting_of_ref": "indicator--645d34e1-8972-47d1-8850-379a93450f2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5eb2485-3170-46cb-b017-cd25e2a1294c", "sighting_of_ref": "indicator--b853514d-9c5d-428c-bd8c-5de43e67760c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3128ecbb-b4b7-4ffb-b873-e7fd45dd6127", "sighting_of_ref": "indicator--667a423d-1fb7-46ac-9166-16ba893d57e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d680bb2-4d6c-4a0e-b0ed-4691de91bfc2", "sighting_of_ref": "indicator--25daf764-4a3b-45b8-99c2-116e5fe6d903", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3a8d12-8af9-4efe-bab8-f3a5a583e98d", "sighting_of_ref": "indicator--d1f809da-9d84-4952-b5c8-690a3f8afd8d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b87cc9c-d36e-454c-9f17-87bc98705d71", "sighting_of_ref": "indicator--2819afb7-32f6-4afe-8d86-9f0da59deb78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad5f0ae-a6eb-43b9-bb65-fdffd60a1912", "sighting_of_ref": "indicator--792fa512-e518-4ba5-9ef8-d96b9fa0dddd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a033ba17-42f7-4609-b656-cb8067c4d81f", "sighting_of_ref": "indicator--8c0330d8-a94f-4f2c-84be-facaad36fba3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2236efbf-0efe-45a6-b4f8-7df94e64f94b", "sighting_of_ref": "indicator--cd218259-9d9f-45c6-89e4-9d3a20b5b3a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4473ef61-db1f-4782-b760-60a3598b9856", "sighting_of_ref": "indicator--cef4857f-6dd6-4182-bfde-fa9c3982c0f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2320259-5df5-4ad2-bf63-7eccb86a7a0c", "sighting_of_ref": "indicator--d6c84305-abf9-4def-a90f-73b025baf6a5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--739e0ce6-71b1-49f8-bdae-aa4d2518f45e", "sighting_of_ref": "indicator--c5ada025-baa9-4ea1-9b91-c947a7305824", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79b2f2a3-fe55-4110-a189-a0860102085f", "sighting_of_ref": "indicator--1cb78daa-e90b-4776-b652-40b9be9c4f77", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3399a21a-4990-4c27-9909-bc9d277c8591", "sighting_of_ref": "indicator--b3947a62-e636-4b82-93ec-d8e07fb1a254", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6902a561-b685-42cc-8fc6-e161b11f38f8", "sighting_of_ref": "indicator--84025ce0-c374-4b5b-ac5f-89ab31eafd7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0d8f6ac-865f-436c-809b-131733039ce0", "sighting_of_ref": "indicator--1d2a7a58-6ba8-4a6d-aa7e-0bb501d2f32d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d8e37e2-6619-4414-a0d0-90f78c98b7e8", "sighting_of_ref": "indicator--d992c24b-2563-4be0-87cd-eff7fc69d31f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7eead9a-5990-4e4b-a8f9-9b1090a62b22", "sighting_of_ref": "indicator--cfdc81d3-6fcf-4368-862b-1bd0b8eb14e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7177495b-ec32-475e-b794-f2433e0aaee9", "sighting_of_ref": "indicator--71e12c70-00d6-4d87-a5a0-e2d222fe7236", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a39832a-71d0-41fa-b98a-633bd86f5144", "sighting_of_ref": "indicator--24082059-9bac-44e8-b1d4-16b5be74d46f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52efdd53-c639-4d0d-b5fa-ce70097806e8", "sighting_of_ref": "indicator--bdcc27b1-cf60-48ae-8cc0-1d747d7b6012", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ebb155b-1674-41c3-93ee-396f8ef8ad8b", "sighting_of_ref": "indicator--363b6c33-01ca-48a5-aab9-9a5d5340a9ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c742cc36-a2fd-43cf-8c38-5292c6b5c37d", "sighting_of_ref": "indicator--693ce958-363d-4e84-a399-03fedde040da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee641c2-5095-4dfa-a757-ea82038eedfd", "sighting_of_ref": "indicator--e4f8aa52-65e2-48d3-a407-d661ee578c27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f22236bc-da55-45a0-a487-b576ab9aeb39", "sighting_of_ref": "indicator--236ae221-a91e-4bf3-b803-0831b8e6fed6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8329fa50-e373-4e20-a7a4-ad632bb3851e", "sighting_of_ref": "indicator--574972b6-013d-453f-baed-29142e23ea45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d46e1b6-7c22-4a05-9d45-650704b19251", "sighting_of_ref": "indicator--7498ee8c-5da3-4db6-82d1-5f5c4c253e7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45dfc6bf-4cb2-4355-92ec-3d356e66cc95", "sighting_of_ref": "indicator--e3d7f4c5-679b-4595-a7d8-d89fcb2bbd69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--087140c3-18b4-4e01-9866-efcdb8d6a1a0", "sighting_of_ref": "indicator--2feb2e27-9e93-4c00-98fa-3b2ee3be13ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c07455-e092-4c39-8d96-b052312636f6", "sighting_of_ref": "indicator--411279df-f41d-418f-bca4-799f415232b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1411ce2d-4746-4582-980f-08e1ffdab770", "sighting_of_ref": "indicator--71306c6f-db05-4a33-8144-957cff36e56e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eddd500-1624-4ae2-8e42-51cd69a854f2", "sighting_of_ref": "indicator--9718182d-42d0-4a01-93fd-d6f22c348404", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfcf1fb1-c4c9-4c4c-894f-bd2914223fa3", "sighting_of_ref": "indicator--40fa2ddf-fe2e-4a04-a775-3bd0b9b6863f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83bfc904-704b-4ade-87b2-3186a9d3d58d", "sighting_of_ref": "indicator--471af2b4-bb78-4823-87f4-4127daf1267b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e38d1bc2-0600-4788-ae34-a128033b2502", "sighting_of_ref": "indicator--edbb4e46-4d22-4b58-9b8a-ca50d6569b3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--419654ca-ef06-4ef0-9eb1-e30cb3dfae93", "sighting_of_ref": "indicator--eeec4377-9dab-46e5-a502-233b3a2924f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--277ab201-9b50-4dcf-bbe2-055c87d46637", "sighting_of_ref": "indicator--077be6b9-8d85-4e50-a186-65e7c4461a9b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb829ca-5ba0-42e1-beb1-096b7dd5dc86", "sighting_of_ref": "indicator--9d1ace08-4db5-424f-a1ce-fd4e1d210e62", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf907104-0658-4946-81ad-d624cdfcf5d0", "sighting_of_ref": "indicator--c1192dad-2e35-4922-8b70-1a4f7de4735d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f254ff-a757-4214-8087-bee31f1a87a0", "sighting_of_ref": "indicator--98479907-6a0c-4dee-85ce-d4490b0fff0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23ce418a-a0ff-4b71-ab07-4e84da4fbdc3", "sighting_of_ref": "indicator--09acbe51-a1f6-433b-a728-28cf94dc0890", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc1bd6bf-8d97-474b-81b7-1e46ae36ec77", "sighting_of_ref": "indicator--56a7a3db-2ba9-4ce4-8e9d-ae7233ef69c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4722d40a-3610-4561-b06d-c265602d83ea", "sighting_of_ref": "indicator--b16524a4-8ac6-44af-a109-e24aecaeea32", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9508a8af-0099-4d61-ba55-92d7e3d5f407", "sighting_of_ref": "indicator--cf041f4c-33ff-49ca-9337-b11c4738d4d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9363fe12-1403-492e-bd38-b45b669b2ac4", "sighting_of_ref": "indicator--5c4d83cb-96af-46ea-9eed-50e822f34504", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53c9479-7b96-4980-901c-4afd6376b88e", "sighting_of_ref": "indicator--12bc243f-9447-46aa-aaaf-cafdf792eb66", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15ad0e7-0b53-40cc-8e39-0d9c0489d7b5", "sighting_of_ref": "indicator--7fdab045-c2f4-4e63-9432-fd71df251264", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19b767e-9e0d-431e-8790-33eb3fa592c8", "sighting_of_ref": "indicator--b535c978-8b2a-4857-93f7-6b958d5caa2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be6d9d89-81ca-4c71-ae3b-e11b8882c045", "sighting_of_ref": "indicator--5b4ca797-0957-4f07-9111-8d1c03b18bac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed7efb6-b6fd-453a-bcb3-faf650bc326b", "sighting_of_ref": "indicator--d88e9c9b-6e25-4b53-8a7a-201f8985624c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00d599f9-4ab4-4fa6-b96a-e22c8d93c598", "sighting_of_ref": "indicator--944bdcf1-7da5-41d3-8d1e-bdcaaedf8f5d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d9e455-b0dc-4485-a0ee-f2ed5271b5f4", "sighting_of_ref": "indicator--06938be0-44e3-4699-91cd-4c196dacfaba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f75ae1c-5f58-41cc-9c1c-c5e411dfdb2a", "sighting_of_ref": "indicator--39ffa5b0-becb-4ff9-a74c-b05eecada115", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acc6f7dc-50f6-44a9-9986-cffd31f823f1", "sighting_of_ref": "indicator--f161b093-bdde-400b-9bbd-e31b962f2cf3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7163499-03a8-4739-89f3-8933c5d3dae9", "sighting_of_ref": "indicator--e663754f-7031-412e-8679-e4a3f68e1f2b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47b34fda-bec5-40ae-9fc6-e40f50d8de20", "sighting_of_ref": "indicator--e7fcf235-2e55-4f8f-a379-df17f11908ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50c3d5f4-1154-4ea7-92d0-95a44f00b48e", "sighting_of_ref": "indicator--3692538d-dd05-4595-9222-35249783f6a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11801f2e-aa95-4f3b-a462-3cf933f75588", "sighting_of_ref": "indicator--930964f7-d557-4dd2-874d-f0bac8228f55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1a08552-a6ac-41a9-a7d9-f8b019f7cfd1", "sighting_of_ref": "indicator--35d8714d-bdfb-4623-8168-bc6f23033c45", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e5d4ed-e0ef-48b9-8da3-3596020cd73e", "sighting_of_ref": "indicator--2b29d08f-eeb8-4756-bfb9-2d85e631d6c0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c45c390-81e6-4a5e-a39b-f021f08bc4de", "sighting_of_ref": "indicator--1854f26c-aea4-4a6a-b555-91d6e7f5a461", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--922d3737-5a58-45a6-91d5-8d209ddb95eb", "sighting_of_ref": "indicator--a952d4a3-0df8-4c98-aa68-ac618d899c4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--586e13ef-ccd5-411b-af16-1b5617688b9f", "sighting_of_ref": "indicator--5d06c3b9-e186-41e4-9ffb-6229e936e2a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eafa47b8-6c7c-4a90-ab96-c1eb06ba5b56", "sighting_of_ref": "indicator--104be677-245c-49f8-b014-bde6602d985a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c983dac4-1e3d-4ced-9f3d-1b791b6cb424", "sighting_of_ref": "indicator--9d35aca1-de11-44d6-8f0a-89d9efbc4a55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8227529e-9187-4504-ba5e-9f2385534424", "sighting_of_ref": "indicator--000d892e-823d-4580-a043-4b0c5a73ba91", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef7db883-eeda-4378-b88a-9e0f506d3863", "sighting_of_ref": "indicator--4f88c368-387f-4112-808d-a72b40fd7d25", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35b3dbee-b44e-4b26-8dd9-ee718de067ab", "sighting_of_ref": "indicator--053244cb-8f65-4905-80c5-19dd0ffcaa61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90cdd12f-e1d4-45a9-b04b-b34de6ebf4c2", "sighting_of_ref": "indicator--987e884a-fb10-4aa5-8e63-217c4c684d59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01577958-0529-4b84-a518-0f509dde0e63", "sighting_of_ref": "indicator--d87af863-0b68-4631-9064-c9ad141dab44", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b46c31d-eef6-4bba-88c6-f082a9c738ef", "sighting_of_ref": "indicator--049cd65b-d3db-42cb-ab95-76dc7f8a7f64", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec34b51-af31-4744-826c-f9754796a6be", "sighting_of_ref": "indicator--5d18f391-c17f-48fe-b51c-799e591da2d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02316fc1-c1ad-460a-9f25-a3348fc7ca3a", "sighting_of_ref": "indicator--7cbbcafb-aa43-4e6a-9753-4110575ba2c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a3abcc-a2a8-43d7-a9df-389fc77d2af5", "sighting_of_ref": "indicator--df1c88b9-67c9-496a-9a0a-4339e59b45fc", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3bba36e-d18a-4366-871e-79023d31af24", "sighting_of_ref": "indicator--6f1bdf3c-3746-4ea0-ac2e-4459d16f93c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8aea27f-8504-4438-a525-f366f6b2a35f", "sighting_of_ref": "indicator--ed8e79f0-2f0e-436b-b08a-ec839a793b9c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e91af229-1b48-4c50-a5d7-a2bdbcf6e749", "sighting_of_ref": "indicator--ebab6fe9-6b81-4bfa-b7ba-2a621958dadd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c6b865-152a-4190-bf5d-7d35722deaf1", "sighting_of_ref": "indicator--6c96fe6e-7547-436b-8bec-49013a599825", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afa0c371-d9cc-4004-8c0d-e28bd813a7ea", "sighting_of_ref": "indicator--aec8927d-572d-423a-a745-c45377e3c6df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a66af0-92d6-46e9-956f-66a66275e401", "sighting_of_ref": "indicator--3b00d0a3-a306-499e-89fe-57a9bce71617", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3977ebb5-c80e-445b-92ee-28cc5de7b8d1", "sighting_of_ref": "indicator--cddcf2c3-a90f-4cdc-9573-4f9af13975b3", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae56d662-4737-4fac-932f-0fba7264174f", "sighting_of_ref": "indicator--0b2acd39-4d7b-495c-b747-a403c0c32c1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f4e629-bd03-4d2e-abe8-30132ae15bb4", "sighting_of_ref": "indicator--0b2acd39-4d7b-495c-b747-a403c0c32c1f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc634c28-23b4-410a-947f-25b4ec2b9e9c", "sighting_of_ref": "indicator--3018e942-1a69-4749-9ad2-9fcf98af25e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0e222f-1199-47c5-83b5-80e978b6edb4", "sighting_of_ref": "indicator--324cefea-e4e7-400a-a8ca-0ab9f2306642", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b29574aa-b5f0-4e9d-97e0-a3fd53105ee7", "sighting_of_ref": "indicator--d456b324-4fd1-46ea-83cb-2a1432cc01c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7053d0ac-7361-4527-96bc-b2f1d4e127f2", "sighting_of_ref": "indicator--00d36239-a733-485d-9951-4f4700d160b3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a4d118-c0bc-4ac5-8dc5-456fcb6c3881", "sighting_of_ref": "indicator--fa2cb0a7-6956-4737-9b78-26a8ad9a16ea", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf8accb-2435-4056-aa05-dd7dd4067bad", "sighting_of_ref": "indicator--264ec3f5-6df0-40cd-b4a9-f2d70fb25e3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb1eef5-cdda-4753-b468-41e6dced24c7", "sighting_of_ref": "indicator--87bf3c76-3923-4ef0-8935-b0bbc6f6c90f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1cfc01e-d58f-4c50-bfa7-c29bd2d623cd", "sighting_of_ref": "indicator--91265fc8-6a6a-4321-bd17-5f54829bca59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df9c08b8-6266-49f0-9ce2-9c265e94043f", "sighting_of_ref": "indicator--7b71f50e-c50b-4206-99b2-5d6b141b8153", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c724da4-be14-4e49-99da-6aa2fb768a8f", "sighting_of_ref": "indicator--db0f9d2c-4bf3-47e6-913b-47efd1c1fe58", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a2bcdc-5496-4d71-a1d5-b521cfaf5ebc", "sighting_of_ref": "indicator--c6f934aa-020c-46f1-9ffd-0651286d466f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13574dbd-3068-47bc-aa38-f894701099a7", "sighting_of_ref": "indicator--3c43bb97-1207-40c3-8f93-de88728c8604", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--040b98e2-0277-4d81-bf7e-1cf46a3a74bc", "sighting_of_ref": "indicator--598fbff8-db5e-481e-9b1e-9ccc36ab361c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ce8632-17d4-4380-aea4-c10723f4c2e3", "sighting_of_ref": "indicator--d7d14c43-3e5d-47bc-af4d-3060a3eac03e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a152f69-631b-431b-a9c5-5dbfd79f561e", "sighting_of_ref": "indicator--70419bf2-b22a-4353-b02b-3aa48d547e7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b88796e-25c2-4780-8106-6934ce09c82b", "sighting_of_ref": "indicator--9054a522-ab7e-431b-a37f-f9c72a343e8a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea6d3cde-9335-4eb3-b590-c9d504e34878", "sighting_of_ref": "indicator--5bc389f6-30c7-4f9f-bbd7-3e7cb782e7ba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f986ce-9302-4c9e-8cd2-78a08a30a60d", "sighting_of_ref": "indicator--254b0489-2e62-4174-b4e6-a6aedbe91420", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad784ac4-496d-4ff0-836c-5305608ad23d", "sighting_of_ref": "indicator--56dd3e97-d927-461e-83bb-e807959bec97", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8089a6f0-7541-4d14-8466-934f3a1d1b63", "sighting_of_ref": "indicator--8c9c1057-0138-4c75-9494-127fc4a3d723", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d16b29ac-4658-4ba6-b5b5-03d62a1cc06e", "sighting_of_ref": "indicator--f7482833-b049-4a79-aa28-a2ae27a34107", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5e475b-95dc-44b0-be4d-e1b3dacf5c83", "sighting_of_ref": "indicator--b07a0740-06b6-4bcb-a39e-bfbedc06abd0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a405ad8-eaa5-4316-a211-430867307160", "sighting_of_ref": "indicator--52c18832-2581-4038-ad58-40d98b7b5935", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9518733-6274-4aa5-aeaf-9cc87efecd51", "sighting_of_ref": "indicator--04bf047d-c13a-46dc-b579-eee24adea747", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81631474-a054-4e40-8b60-0c4e840abff8", "sighting_of_ref": "indicator--491154da-afee-46c6-bc5a-10b0901eca80", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5934f1d1-6333-4c63-8251-8d03232f4323", "sighting_of_ref": "indicator--77dfa48b-9d82-4d1e-a7b4-d10252d4de03", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0fbabe-1779-42aa-8e40-037bb44fd61d", "sighting_of_ref": "indicator--ae3b0f86-8d6c-488b-8c11-64debec55862", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd1933cf-9bdd-4504-9162-3148278fb094", "sighting_of_ref": "indicator--cec4d2a9-4e1e-4f66-b280-c292091af6dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d60495c-239d-4a49-bc13-891e3826cd8e", "sighting_of_ref": "indicator--d826f196-0a15-4776-8482-d97d4991f2fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7906239d-02b4-45fc-b776-424898f2a8fc", "sighting_of_ref": "indicator--2708807c-507d-4445-95f3-274f852857cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f91a141-7737-47d3-bc93-073ec9f75d43", "sighting_of_ref": "indicator--8def1e6b-bb90-42a7-95ab-3b07b9cb1292", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cf17152-ee07-4d3c-8993-60905d2e83a7", "sighting_of_ref": "indicator--297250da-2e6b-44d3-8af1-39bca1f679d5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb1b4309-5b99-4451-9526-7bbce98b2a8d", "sighting_of_ref": "indicator--28ee5452-af42-4e67-96df-deeb30990ae9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bf97c5e-758c-4b81-b981-59fd4c01906e", "sighting_of_ref": "indicator--869de84d-dd73-4168-aef2-47045997aacd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f645d87c-dabc-4a22-8a07-f2ce319d1c62", "sighting_of_ref": "indicator--542e363c-35e6-4697-826e-8cbaa6eb2f06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ad5c84-0f34-42ce-b34f-cc1a6b2454b2", "sighting_of_ref": "indicator--0392e6c7-2dd7-4120-a21b-343ea2462bec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bdd1478-8eb4-4897-af11-6b724a0ec0dc", "sighting_of_ref": "indicator--b43a7d0d-1688-4025-abbc-3e49f6b2ca79", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1619dc0b-fc9c-4565-a3d4-392f005eeba4", "sighting_of_ref": "indicator--c9e25f94-ed5f-495f-a609-404e03c6bbcb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65bb9cfd-215f-4eb8-83b0-e4ec5fc6c8ee", "sighting_of_ref": "indicator--aa917b67-a083-4c50-b49d-e208cb902b57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4814ef7-cc4b-4237-a8e8-9c85a74b5908", "sighting_of_ref": "indicator--6cd433c9-64a1-4348-bd13-b34ebf5f9463", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab146cc-dd5e-4c7b-836e-a781a55a52fa", "sighting_of_ref": "indicator--85342b5c-b3a1-4f29-b42b-552f0afe66bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d55d23-5384-442d-b3d8-481ef757efa6", "sighting_of_ref": "indicator--c9e61f1b-eaed-41a9-8ae4-57a4dd6371cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca54fdcc-5b99-471e-b416-1f53fbabfa90", "sighting_of_ref": "indicator--784ecc3c-b87e-4ca1-87cd-bef713e0b10d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62598c32-a440-4b9f-a064-978d314ef0cb", "sighting_of_ref": "indicator--fe1f5d30-8d22-445b-912f-cd6bfdd0b27f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d478f1-b8c0-44ec-a538-e4d03e681c4e", "sighting_of_ref": "indicator--28e2720a-a808-4fb2-91ba-ed6ec003da5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6e1731-7598-4d30-8888-477f6d86a47b", "sighting_of_ref": "indicator--e90e088c-db61-451d-a07e-47adbb1fbead", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84e3955f-a5f3-4129-a399-8d282cdda63a", "sighting_of_ref": "indicator--e597bf7c-e376-43e9-9a95-1a0d497fe9bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8337b167-2215-4a14-ac4d-3dc4415f0102", "sighting_of_ref": "indicator--d1e70536-a0b3-4863-95f7-4cd316832e06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72565cbd-2d39-4605-8201-534cb95c5d8d", "sighting_of_ref": "indicator--f8665aa0-ecdd-44dd-aadc-728dc03061d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--646e9234-e9d9-4fd2-9127-51e8eb7d1b84", "sighting_of_ref": "indicator--de9de22b-6ef6-4c40-b2aa-11f28bcd0662", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506eac16-a964-4f99-9bb4-82a2737de7a9", "sighting_of_ref": "indicator--e9dde52c-666d-4e7c-b0fa-f05dc2befdd7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cac9075-42d9-400b-9748-016ac2c277da", "sighting_of_ref": "indicator--0a5a7b2d-4d25-4ce1-bf0d-dca0dcc22609", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32631e45-4598-48f9-a6b6-aacb3eb1485c", "sighting_of_ref": "indicator--46c56d77-78cf-4a54-b8ac-628e3648b962", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c98c02ce-f6bd-4314-9d7f-93d7e26895a5", "sighting_of_ref": "indicator--5b165618-e496-4b30-beaa-f7237d3b2fee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ef76fec-7fb8-47f3-b76a-7981ee67f3fa", "sighting_of_ref": "indicator--bce02543-0e72-4634-9ccf-4e03b30ba533", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fec23f0-9a86-43fd-9b08-e2bc12d57692", "sighting_of_ref": "indicator--b6abf641-09e8-40ce-a9d7-15baa1b6b2d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--872f6f5f-3d23-432e-a26b-d027dd5a6436", "sighting_of_ref": "indicator--9a49d5d7-bf70-4272-b0e1-848c5e7325c0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8bc1b4b-8c61-4783-9aab-101bc2e2877e", "sighting_of_ref": "indicator--fe983510-2165-4a5b-9dbb-5bbdbd36648c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56e1288d-8b3c-4be3-85bc-2d0df07e817c", "sighting_of_ref": "indicator--4d132e2f-6fb3-41d1-b41c-c6af747be4e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed0c7ccb-e81b-4051-af29-85dd677cc302", "sighting_of_ref": "indicator--cf8c1c89-7d0d-4181-8649-554982471290", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d796c18f-2447-419d-b336-a6452f49f25f", "sighting_of_ref": "indicator--2de2ca85-96e2-4170-af20-5713a6d8ecb9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba6d1c80-d33e-42d2-b153-318d533d84f2", "sighting_of_ref": "indicator--34c3540a-29ad-404e-a3d6-8adf01361185", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e4c33c6-60ee-41d8-8782-d7d7b6ac50dd", "sighting_of_ref": "indicator--9d8c80a8-56e8-4a92-865a-82450b854f3a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96690e77-3b36-4030-9da8-bfe8d8558036", "sighting_of_ref": "indicator--72bd0ba1-d3e9-4876-9a74-5dd967d63688", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ee61a44-a86e-44f4-a76c-db2de14ed8bc", "sighting_of_ref": "indicator--0a77f789-143d-43af-ace8-b0559c9cb7f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bc5cfb6-9815-46d7-83f6-d352a054f17b", "sighting_of_ref": "indicator--2c21ebf1-50a6-4484-8bc6-8ded87d19d29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--231d5c40-e7da-4e2b-a651-c2479880c923", "sighting_of_ref": "indicator--9fe90b2f-0002-4d25-97fd-13e6b99ea9ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba4e3500-b5a5-4ec9-a5f5-4119df3e3952", "sighting_of_ref": "indicator--b4ecaf4f-bf91-4519-98a1-ad2aee25e6a6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fa65cee-e9e9-4f86-99a4-229a71ed9d04", "sighting_of_ref": "indicator--28e685f3-26b3-4874-ac70-b8af08708b77", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf7089af-623f-4ab3-984a-c53fb2c0e777", "sighting_of_ref": "indicator--7574113b-7c93-44aa-bdcc-7d0178c7493c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c68f59f5-067b-4a07-bc3b-bbd9c562a36b", "sighting_of_ref": "indicator--a58c1c92-b4f5-43d6-90df-2dc9d5ae583e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e517f539-88cf-4838-8e43-8d0797e878b3", "sighting_of_ref": "indicator--802c0015-288f-4d5a-9549-3d82e61e728e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92c26dc2-a4b6-46c8-9141-f98af09fa7a0", "sighting_of_ref": "indicator--60c92eaf-9dd4-4970-93d8-0fdd1609233e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7357e3d2-8ee9-48b7-af42-4e3ba87b6f9c", "sighting_of_ref": "indicator--22b36fc1-0fa3-422b-84e4-d1d89cb7e1e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--675a6059-8cd4-45ca-a5a5-111a9464c0cb", "sighting_of_ref": "indicator--29c85f69-ca0b-416a-888e-fb66bac5fd1a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b8c25ee-3c24-48d2-9368-d933c5cc70ef", "sighting_of_ref": "indicator--0ef58200-e071-477d-9a8e-9d2bdf52e10e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b64d6f3d-5056-4b99-8510-2bcd8d31f073", "sighting_of_ref": "indicator--36ab2a58-05c9-49cd-a074-cec6a5f1df9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d993e0-d7dc-4247-b1f5-a02490461679", "sighting_of_ref": "indicator--8d7dbcbb-765e-40aa-aeea-503b62f73112", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bd0d6ef-0f85-4396-9e81-74699fc51f61", "sighting_of_ref": "indicator--04aae96d-d666-485e-8b28-31ad6e0733be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba751c7-3dc4-4530-9b8d-a2c14ff2c9d1", "sighting_of_ref": "indicator--de72d201-ea93-4d5d-acb6-6a69baed479c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534be0ed-6c7e-4259-a0f0-9bb03adfab5a", "sighting_of_ref": "indicator--d841ea0d-657a-4e27-9757-5b1704569cd4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d48a251-86de-4d40-a1e3-de4f1fbce5b0", "sighting_of_ref": "indicator--f50d359f-83dc-445f-9fd2-0edd97980070", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97ace3a9-9e4e-4cdb-b65e-12609a5ed070", "sighting_of_ref": "indicator--e41701df-655b-4b81-8a4b-e93c78a00e5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--347772ac-745c-4f45-bcdc-b004d9e001c7", "sighting_of_ref": "indicator--905afd27-207f-46ec-81aa-36208e7a9e98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a52b902-5fc3-4a7d-8909-ca423a136b4c", "sighting_of_ref": "indicator--e385b0ef-8c38-4c8e-826f-2de07fad8fd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c420651c-59ad-479a-a59c-506e34aaff67", "sighting_of_ref": "indicator--058cde9d-502c-4747-bbb2-e5cd820c297d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6bf1ccd-7d2c-4f5b-97be-660a195e3e18", "sighting_of_ref": "indicator--3b71084c-920c-4600-8dac-7eca755ae306", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6c4548f-0872-45fa-928f-8adccec24b7b", "sighting_of_ref": "indicator--ae6fdb92-e28f-4d23-b511-691debc2d80a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9666a7-11ab-4452-93b0-ca93768d46a0", "sighting_of_ref": "indicator--62efa92f-e49f-4c3e-9536-7c45b6f1a853", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c8a3271-7b14-417b-bec5-159bfcd07773", "sighting_of_ref": "indicator--64d386ab-724a-4af1-af81-b42bd1c8ff02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a46a697-79c6-4f2f-a56b-aab1a95b3a2a", "sighting_of_ref": "indicator--08dbe869-5d95-4f5b-9153-0d67d23c287c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c1dbdd1-0128-4c98-a2e8-1f1b1eaaa5e2", "sighting_of_ref": "indicator--6083da68-df39-45d6-99cc-c59f1aeea9c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--310489a1-a000-4c1a-a593-949ceb7b0644", "sighting_of_ref": "indicator--24146757-76fe-42d6-82bc-dd963367e76c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fdf7e3c-9d1a-4202-b602-2376385dc8d6", "sighting_of_ref": "indicator--6b376de2-825e-43df-a2fd-76c45b1b3249", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abc0567c-c7aa-46ec-ba88-a9c7e3dcb4f8", "sighting_of_ref": "indicator--417271fa-f9db-4e75-91eb-d8973e2ce801", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f08befe1-6606-4bb8-86ed-9cd0180e5144", "sighting_of_ref": "indicator--74121b4a-6672-4891-a14f-97e3a1491821", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e0415d6-69e6-48c7-bfac-6bafe5b9e1fe", "sighting_of_ref": "indicator--5f68dd34-e845-48ae-a392-9dc00a10ec35", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87fc4d9-f448-4b1e-b3fa-6e524c2cb729", "sighting_of_ref": "indicator--52cb4fdc-e138-49b1-9f16-c391a2f387c0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c0bbee-78a7-4a6e-898c-174acf7fe049", "sighting_of_ref": "indicator--cbf2a80e-ca74-41af-8479-caf17f9546e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5651c322-0c57-4f7b-a5c1-e3e49d6159ef", "sighting_of_ref": "indicator--3db38c7b-0033-4616-9fce-5e7d24772eb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049c2fe4-8e82-4c10-bc81-12188d5875b5", "sighting_of_ref": "indicator--cdaa2c13-b836-4d67-ba2e-b441541d2d37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7fa1990-c792-4a56-8936-986ce613eba3", "sighting_of_ref": "indicator--509c7872-cd6a-4e04-b52f-735250178fb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c600cc89-29e4-4338-82d1-06b141bc376c", "sighting_of_ref": "indicator--4cb484c0-999b-446a-aa1c-c3250dac52bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ecc5d8a-d71f-4c8e-86ea-412c889e4647", "sighting_of_ref": "indicator--e08811b3-e54d-4756-a627-fdd86245cacd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f7a94a-42dc-4ab8-aa01-7f728cf81d72", "sighting_of_ref": "indicator--afe1e4bd-f7cd-4879-89eb-ad240e07088f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--379eba7c-2553-4681-ad80-be8175a2d439", "sighting_of_ref": "indicator--4d0f492b-aaa8-4365-b682-324e3826ca37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a356e3cb-159a-4bb1-b627-e3b121e4b025", "sighting_of_ref": "indicator--a43bb2e2-f4fb-4bfd-b7bd-dd96497a6500", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b679cf96-ab63-4be9-b6c5-7ff82291a8d0", "sighting_of_ref": "indicator--5a8baec1-9b54-4dec-afa2-4fc7061a4b1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--874da16b-a1ec-4bd0-95b5-51618750ba60", "sighting_of_ref": "indicator--b358d133-4989-4355-bdcf-3208cdecbd37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f909a49-9b48-473e-9bcc-908d261a011a", "sighting_of_ref": "indicator--bfa5ae2e-8c46-4cd7-bc9d-d497915af74b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d540ee4d-3a93-4034-9ed5-18d8d702de1c", "sighting_of_ref": "indicator--325d0ae0-f05c-4944-b419-2256a5bf92db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f20ce928-64c1-4122-803d-b209ba39d6ae", "sighting_of_ref": "indicator--9b1813c0-18b2-443c-877a-25638553acaf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb84d4c9-a809-4277-bcee-893c34a1f854", "sighting_of_ref": "indicator--ddb897c0-2ea7-4731-9855-a89b9cc65fdb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ae0d23c-9afa-42da-af53-5c9afcdc0000", "sighting_of_ref": "indicator--c8629d6b-502f-4066-8cd0-bde0bdc8aeed", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29ddc4f0-55c4-437b-9bcc-482b191bea6f", "sighting_of_ref": "indicator--4531dbbe-a1f4-4d92-b4a6-180f1e26670b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b052472-52ca-4970-a418-6e9a38688a38", "sighting_of_ref": "indicator--f02bb182-eb0e-4ca8-863c-4b219c2a4f24", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737e4e1e-67b3-4144-8697-fe6df257c366", "sighting_of_ref": "indicator--e37cfe2f-cc6d-49c9-83ff-66c1e16d119b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c876fe45-22c3-452e-bec2-267d9d2bcefd", "sighting_of_ref": "indicator--a8b6f6db-a7d8-4b99-b1ec-f8f6cfd7b223", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a467b40-cb90-408a-bce8-49c0ecb1f117", "sighting_of_ref": "indicator--c0620455-e0dd-4d02-bce9-bdde180f207e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80fdf836-c66d-4066-bd68-e318bd7f0d8e", "sighting_of_ref": "indicator--7336ca45-180c-4f59-ac1e-f73561b5b354", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf44e022-639c-4a51-b2b1-965763f3ff6b", "sighting_of_ref": "indicator--fc418b9a-19ec-4591-ba0b-da6a0d8b1069", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ada847a-38dd-4482-a2d5-c9ecbe2d7318", "sighting_of_ref": "indicator--2b0415ec-d16d-43e3-bc4f-07ea89dfe3c3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bba02b1c-cc65-4c33-b9fb-226acf9863d3", "sighting_of_ref": "indicator--7a2dfb2c-45d9-49cd-88a8-c59873fd728a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0f02099-6cf4-49a7-b67c-4106c748b4ec", "sighting_of_ref": "indicator--7039d388-bf0e-403f-86ff-97beb83e8923", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7ee5071-5cdf-4ffd-a6b4-d4380686eb8b", "sighting_of_ref": "indicator--318a4828-4b9b-4c52-94a7-0c1a4d3932e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67fd33fd-3b5e-400e-83a5-9213912437e8", "sighting_of_ref": "indicator--c5cedc92-a546-4e54-aca0-45997bde7d8b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ed23709-96cf-4c42-aba8-0ac780dd45c7", "sighting_of_ref": "indicator--896db334-c63e-4c51-83c4-f0cd9804c6b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c291bfbb-f691-4109-bfd8-0e94ca868eab", "sighting_of_ref": "indicator--28dc69b6-53f9-4782-9cd5-224f194582ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d273eec1-8584-4955-9a2a-170406863717", "sighting_of_ref": "indicator--f69cb840-054f-417c-961d-3496234f5c47", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56ceed71-e74c-4aa4-8c8d-2799282e2403", "sighting_of_ref": "indicator--5be04780-4484-4063-b1fa-882631822b45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98ebd43-633b-4dc0-ad23-8c7abdabd93b", "sighting_of_ref": "indicator--5428c2fe-46e8-4f65-8aa9-1059aef1ae8e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f26c857-bcd9-4c41-8e36-57d94238ce9f", "sighting_of_ref": "indicator--76342c9a-abb0-4363-961d-2adeedbeaf94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc29911-34f7-498c-bf2b-7c7f6f75c1ad", "sighting_of_ref": "indicator--75f39c96-e672-4d00-87d4-dc472c83e2c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--310dfc1e-56d4-4d9a-b62b-e5e8f6b3f97a", "sighting_of_ref": "indicator--ea0ee0d8-274e-4667-a2ec-cd72344bebfb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6751eb-e4b0-4fb2-b9c1-7bd809a9d810", "sighting_of_ref": "indicator--73b2eae9-d493-4abe-949b-0fd75df7fff1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--573dc960-59e9-4795-b143-38df1fee6795", "sighting_of_ref": "indicator--b6417d77-49b2-4831-9cf9-cf066f359397", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--569ba631-d9c1-4a77-9bff-b0f642253ea9", "sighting_of_ref": "indicator--f0ecf97c-5949-4e44-8ed0-baeb877ce199", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05740d1-4ad1-44ae-b568-42ef66412c04", "sighting_of_ref": "indicator--33b5c9bd-54ad-4e86-baa9-852a09abc059", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1236037-4f9a-4c21-8ad4-489d2501e900", "sighting_of_ref": "indicator--c278d53d-8976-459a-bc41-4bc08507a241", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00bc6e17-c67d-4154-b39e-247592424bb5", "sighting_of_ref": "indicator--c33405a6-029c-411b-980e-6eb84a1470bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d0ab553-ee9c-4131-a5e8-5577d6bf9a42", "sighting_of_ref": "indicator--83fb1d87-3cea-44be-bc3c-f6cbec94ee76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--765f8638-aef6-4970-acb6-028e12585508", "sighting_of_ref": "indicator--adda69fd-8b27-4dfe-b2ef-869bf1878819", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5738b8b-5b8e-415c-a0cd-1b71129da60b", "sighting_of_ref": "indicator--3ca5deaf-d503-4394-b1f6-f8a78e8cce90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--267b289f-65b7-439e-8fdb-b092062ece46", "sighting_of_ref": "indicator--01450f74-ab8c-4204-9977-8b75ec8e0c1c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f5d9541-387c-4db9-88bf-6af92df83af5", "sighting_of_ref": "indicator--fde18f09-c695-4f62-9a3c-0d939e4d7636", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba9ff5d8-e40a-4195-b9a9-17a3d7ecd046", "sighting_of_ref": "indicator--4021a573-5aa3-448e-b989-7f7646fa2fb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f509a66c-d7ba-4243-a6d9-5b86f84f8e3f", "sighting_of_ref": "indicator--877fbd0d-bd1f-486c-b6c9-876b2ea8aa85", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8794d12e-8f5c-4708-ac30-5a1adc256582", "sighting_of_ref": "indicator--205cc611-369d-47d8-8918-8af6e768602e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7876a3e7-a7e1-469f-9735-7544c3419750", "sighting_of_ref": "indicator--ff809ef0-4550-4bfe-942f-c03c5504f04b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a2e7747-60f3-4e5b-b897-074c5572c1a0", "sighting_of_ref": "indicator--cb831460-ac6a-4fbc-8bb1-44b96a563e69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f974e4d7-5f3d-4dbc-801d-8d002cfdbedb", "sighting_of_ref": "indicator--30775f11-3a52-4deb-adeb-15dc75bd5541", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f70021a3-0d4f-41cb-a628-3df631d073b8", "sighting_of_ref": "indicator--9dbb77e9-41a8-4109-bf35-cb1e19e42484", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b61b88e-348e-4f7d-83d0-3a55bc48cc14", "sighting_of_ref": "indicator--fbb7eb2b-f755-41be-9605-bd330941d916", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54250e0b-0bdb-4007-94b2-e8a181bda2ff", "sighting_of_ref": "indicator--e40b3f3e-8d46-4836-8b32-f34db806efdf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d457694-7fc2-44f0-825f-397c9c791f2a", "sighting_of_ref": "indicator--ffb0cb96-e38b-40a5-a2db-9bef414376bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ed2f24-0385-46ae-9b0b-3268aae866e0", "sighting_of_ref": "indicator--d8c8ce7f-51f2-4708-b517-fee7a317cdf2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76865835-e3e2-4882-bf29-6cdd5db47023", "sighting_of_ref": "indicator--cbb8b734-d3c2-487e-8910-d2f50077cb23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcb51d4b-b9f1-4499-bc3b-e5dfaec3e6b3", "sighting_of_ref": "indicator--e690136e-a2c2-4633-81d6-d2b37c31fab3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0413fe28-16df-46ba-a6fd-799e5a9043cd", "sighting_of_ref": "indicator--bdf73193-b260-4891-89a5-ea5610a25d0f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfdf5c37-ae9c-4595-ae3a-998689011513", "sighting_of_ref": "indicator--b757ce8e-88a0-4c25-a703-c1350d4c1f40", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aafcca9e-c9ae-4aca-9c7f-5ca090cf6bfd", "sighting_of_ref": "indicator--e43e3904-ccdd-48db-b7a8-511099db7a76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a68123e-cd55-44c6-b95b-90070ab02e77", "sighting_of_ref": "indicator--1206bad3-ad6d-4d43-b4ab-3cbefd5f3fbf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e77221f-de58-48f3-b40e-d4c4597ba932", "sighting_of_ref": "indicator--91357f1e-5f13-4601-b7a4-05fe4ba66792", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--345fe2d6-63d0-4ccd-a27d-68f7f2c5808d", "sighting_of_ref": "indicator--b939fc79-de5c-4051-ac98-db5289352f93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db2cf5b-c5bd-4ae3-bebe-709e86196904", "sighting_of_ref": "indicator--7f1eb3fe-bacd-4dbb-9940-0be85231145f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d47f0bd-9a60-4f72-9b97-609646d93c80", "sighting_of_ref": "indicator--7d581b25-e098-49f4-9e37-bb893dcb7353", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--573c0ca7-ed4c-466e-b90c-ad96505cb974", "sighting_of_ref": "indicator--6f0150a7-d763-4e15-81aa-e13b7b7bcd3a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9265e549-7c2e-4f54-ad0b-f1a2c9834b4c", "sighting_of_ref": "indicator--f742af2b-a51f-40f8-ac53-d7b9e0768095", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b59b495c-1250-45d7-ab48-7234cdd5b769", "sighting_of_ref": "indicator--f8358178-8e44-47c9-97eb-5ef1f086390f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21c405c8-429f-43c0-8876-42900df26041", "sighting_of_ref": "indicator--3486aab5-85e1-4c4c-941a-fa99f0add7c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81e1b3b-3e4e-4c0f-8fc6-1e4151f57e18", "sighting_of_ref": "indicator--04ebbee7-c6c4-44da-9e54-6b2241fdaa2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45cfff13-1427-4031-ad15-4b1b58fd893a", "sighting_of_ref": "indicator--d0be8d5c-3ae1-4f9a-8bdb-a742b3d96c0a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--090c8823-8f9f-4125-9ccc-309cb0aba711", "sighting_of_ref": "indicator--310ee24a-4abd-457d-a6ae-1a04431d2216", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60240d16-cc3f-44a7-ab83-686aa5be22b7", "sighting_of_ref": "indicator--05f6d2f6-97d3-44a6-8fae-3028905034ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ccb1a28-ebbc-41e4-b2f0-1c3c2871c37c", "sighting_of_ref": "indicator--bc365034-03bd-4d21-b932-591847b4da36", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c61474d-aa37-4cc5-b3ef-57e37cf38544", "sighting_of_ref": "indicator--6f3f06db-9876-4f46-922e-bdbee403c1d4", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f52068df-5f47-4f31-8817-6af77a4f4e5b", "sighting_of_ref": "indicator--68b7ca03-3764-42ce-a81e-cc5404377680", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4b44ff-69ee-4cdb-a7bd-5aa5d0652052", "sighting_of_ref": "indicator--df3174bf-bb06-4a24-a4d0-d5b2fe8935ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd72f82-8855-4ddf-be06-af6b35287590", "sighting_of_ref": "indicator--560b1e4d-36f0-43ca-b33c-0519ac9191ca", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1983dc25-bfb8-486e-8a6b-2044d0f92ac2", "sighting_of_ref": "indicator--f7c98765-def8-4b64-bffe-4e32af539566", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--605f6fc5-706e-4a00-b425-65c84c06f5ba", "sighting_of_ref": "indicator--1dd5fb71-27c1-428f-ad1e-05daff87713f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035af8a8-46b5-4721-9885-e639a891d357", "sighting_of_ref": "indicator--e56d2b77-6fef-40a9-872b-7a90cff3996e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a8d6898-131b-4268-ae39-a2f8738e6dff", "sighting_of_ref": "indicator--8a8307b8-20c1-4928-b650-bb04ac64590b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf528087-f3f7-4c6d-a063-79c69fd94e1c", "sighting_of_ref": "indicator--bed6c265-8cae-4095-ba0c-fc3d182df566", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5ef3e07-2b7b-4a7d-be33-dbbe2356715d", "sighting_of_ref": "indicator--6d3eb648-c1c4-4d14-8c77-ca43fa76d4e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bca2d639-be4e-41bc-b6f1-87f885d7621f", "sighting_of_ref": "indicator--0a5a8003-cd70-4deb-93d0-a8d7b403304f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96d70c49-b079-4926-b780-e7cdc2ec2ce3", "sighting_of_ref": "indicator--5b242112-b156-433d-9797-828814ddf1a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2726f455-6072-4187-9b66-9f0738081261", "sighting_of_ref": "indicator--3bc7b43b-d410-48e1-95a6-d9351ce13288", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87fa2db1-5ea5-418f-a7a3-22c5d48cd3cc", "sighting_of_ref": "indicator--b0668ce6-21cc-452a-bd39-d01360d6818f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74d4475a-4e36-40a1-b6c0-b00d4b028f24", "sighting_of_ref": "indicator--c151e851-599b-4223-8ab3-c05db72e38ca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b01babd-d829-419e-8ed9-8271823ab5b7", "sighting_of_ref": "indicator--2aaba814-87a6-4b0a-970d-c8640d4a1431", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4832844-0c1e-45a7-aa77-43550eb37bc9", "sighting_of_ref": "indicator--74523c57-8971-4003-8a52-173fc3bc239a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61d38b7f-6b89-4e8b-a9a7-5f8829ebe431", "sighting_of_ref": "indicator--126a5fcc-ac80-4f42-9dc3-c09b6ba924c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--356040d1-77d8-4a8e-a275-c96b8d9db088", "sighting_of_ref": "indicator--f336d5e9-4b01-4d5d-a8fa-9e474b7694b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b5d27b5-5ba4-4cb4-9dae-549fab5c3e49", "sighting_of_ref": "indicator--648a6644-a8f2-4c67-bb79-494898fb3100", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90fb3441-6904-4e7e-b5d2-05c4ef4f69df", "sighting_of_ref": "indicator--22c3600c-1b79-499c-8cbd-e29eabc8cab0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a4c5d65-a66d-4a9b-9d1c-09980950b3af", "sighting_of_ref": "indicator--3763d8e5-e14e-4597-90f4-5fe28b0d592a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a64f016-e434-4fa4-af64-75eb4eb22b5c", "sighting_of_ref": "indicator--02a4ff26-d0dc-43ab-87a2-2a122f7d1869", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c1fcc60-26b2-4b05-ad78-6d47d4f28694", "sighting_of_ref": "indicator--73cb9883-a083-4ec5-95e2-c06c4d50becf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2800ea28-61b5-43c9-b5af-1bd9e4780f14", "sighting_of_ref": "indicator--a03227e3-c73a-4c56-9a77-95fc087226b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f09ca3-a42d-48f0-9110-de3939cfef8d", "sighting_of_ref": "indicator--0a87b115-5395-4ddd-8b71-9d8bec911121", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59e5e987-d060-4943-9925-466789936eab", "sighting_of_ref": "indicator--57a52ecc-415f-4e07-822e-bdb56c35e70c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20094907-cb32-4b00-b56a-78c9871c74f3", "sighting_of_ref": "indicator--2eafa694-b812-4ad5-88da-b1010d6c42b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26a01d82-8b74-4603-88c3-1caafc73cf74", "sighting_of_ref": "indicator--c7b27098-5ba8-410c-b6dc-b0f015e197e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7862f17f-eece-4dc0-92ad-3fca364812a7", "sighting_of_ref": "indicator--b9313974-1221-4b5f-9758-aa5dfdee1731", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10f09ce7-9d9d-4bd4-b792-451c2688f8ae", "sighting_of_ref": "indicator--c9d56243-14ab-4cf4-8f79-7e9112832709", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1179f543-39ca-4f37-a2b6-40e3d3d4b689", "sighting_of_ref": "indicator--ad313dfd-45c3-421b-bae1-8194037246e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f948470-bfb1-4481-9401-eb8a7aeda870", "sighting_of_ref": "indicator--2940e930-d33d-4483-88c3-6eadd077d45a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65e7fb28-73e0-4ccb-937e-7f9a85df8a6a", "sighting_of_ref": "indicator--2ff917a5-6025-4987-8f13-412551d1cf9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f6a08c-323d-433a-ab42-5467dde9b0c1", "sighting_of_ref": "indicator--e4f5a7ea-2582-4c43-b4bf-f30f439083cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a58e5d6-18e5-49d8-8bc2-662aa2d3503d", "sighting_of_ref": "indicator--d4c10015-32a5-4a50-b2f8-71cd91774481", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97571b3a-5b28-4209-b982-45dd8be11786", "sighting_of_ref": "indicator--8471e638-3a3e-4914-bd28-6c9ebc66752a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d72d41f-4fbc-4210-a743-6f0ddd55f27a", "sighting_of_ref": "indicator--e7183680-ed0f-4546-bd1a-1b773914652a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2427e26a-76a3-4052-b506-f6844aa2ed22", "sighting_of_ref": "indicator--f16aa345-a2eb-4156-9756-9ad3e51d9279", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e00aa1-66c6-4b85-949d-fe72596f84e7", "sighting_of_ref": "indicator--e61fbb51-59df-4436-80c2-3f79f7653b99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70a717db-4c5d-4d16-8caf-763a74f5c84b", "sighting_of_ref": "indicator--94a9b28e-e519-4788-bd8b-baa248a9e2a6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7d1b59a-7aed-43f1-be5f-8808747ea8cb", "sighting_of_ref": "indicator--ab41a3bb-7db1-4920-a924-da6bc17c7f42", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46b4f043-bcf2-4984-9010-54af4dbf4366", "sighting_of_ref": "indicator--ec7b3ff9-4fdf-4cf1-b3e5-a882dc11b269", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e81f084-3de3-4553-afc5-d51ca982556e", "sighting_of_ref": "indicator--6d88900f-ee3e-4995-a3b4-609d1d6310ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3804e2-2c82-4f3e-8064-35f9b2f7761f", "sighting_of_ref": "indicator--4ab21da4-0662-4143-96f9-d0c4bf041858", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475140bd-2250-4231-8662-495467bdb20a", "sighting_of_ref": "indicator--ae50b616-e59e-4878-8b2c-42284d851450", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65e1037c-aae9-42c5-bb7c-fc8e38ff928c", "sighting_of_ref": "indicator--33e49ab4-c2ee-4ef5-8b65-0e90faf68373", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--370ee09a-3b12-4e01-888b-99bdb5de708e", "sighting_of_ref": "indicator--2fcd80a1-2703-4d4e-ad97-a0ba552b8b95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76ec8520-1214-4aea-973b-1e27355a212d", "sighting_of_ref": "indicator--5a8e456f-8515-4dbb-8d7e-f74efb4676ec", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c56a224-72dd-4a7c-b16d-c0a898407908", "sighting_of_ref": "indicator--231fffc2-4c91-4800-9bbc-39888194ba1e", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61020abe-9e3b-4c66-b284-978a292fc001", "sighting_of_ref": "indicator--72a8ed35-b8ab-4ab3-9260-10d135287c2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd3a8a07-6fe6-46d0-bc87-bf36f4faa4b8", "sighting_of_ref": "indicator--c87fa53d-983e-4933-b4b3-7168857f8608", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab59c18a-e3c0-454f-96e6-1c2cacc7e735", "sighting_of_ref": "indicator--4e94380a-f678-4fbc-a3a4-741e52df8e49", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1629f94-5633-4a2a-b5ef-5ddd182d8c6f", "sighting_of_ref": "indicator--2dbbd57c-3fe2-40ca-a0da-6b5c9335d43d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13490f69-a53b-4842-b504-b8dc4d1c4f51", "sighting_of_ref": "indicator--07662084-6300-423c-9eab-f25d897f22dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a0a54b-553e-4276-a15a-5d23f9e0f800", "sighting_of_ref": "indicator--7f7e1294-8ef7-45e8-b462-0060af1808c3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c730ed2-3fca-47af-892e-d4963ae0d973", "sighting_of_ref": "indicator--ee5acf0b-074b-44f6-802b-a3df7d74b68e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95538fbb-661a-47c4-bbf4-70e8cf306c82", "sighting_of_ref": "indicator--8cfef5bd-dcdb-40a8-896f-60425c2e060e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82d353b6-e1ed-48bb-b2d3-e808e40f05bf", "sighting_of_ref": "indicator--c77d8173-efba-49bc-a94c-a681a9358a62", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--241e7e1a-a18b-4e9b-8a88-7f7b5d0b7cc7", "sighting_of_ref": "indicator--77c9791b-a0c0-4759-b075-562f3ac5b9b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee5c0eed-da93-4890-991e-b595e97911e0", "sighting_of_ref": "indicator--40a7c778-9e06-428f-9a2d-695793d02143", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4dc9f2c-bbf3-4774-8772-39c468595538", "sighting_of_ref": "indicator--6a1b98c8-d301-4182-9538-4b035f7d9678", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--188c45c8-be88-494d-a59e-7de02b37c267", "sighting_of_ref": "indicator--ade92aab-a4c8-4476-bf6d-00eaa63b7e3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b31748-1b3e-4f97-8c1f-8bc80d5c2422", "sighting_of_ref": "indicator--d30d72ba-4908-4b9e-b306-879f26aab659", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36ca024-0072-496b-bcf0-20e2c20f124e", "sighting_of_ref": "indicator--bf7c47d8-855f-4bb9-bd7c-1f1cf0be36fa", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6604340-e53c-453c-9152-bc38b8776e6b", "sighting_of_ref": "indicator--698f221d-9bcf-47e5-970d-a826a3b9b99f", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eaf298f-ae26-4864-9314-832a54bb4153", "sighting_of_ref": "indicator--bbd98da9-03d0-4cf3-839c-c389dfdc40fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67cec15d-df95-4992-b8f2-ed397d550839", "sighting_of_ref": "indicator--bd9d01bc-07bb-4278-aa19-4ac7eee6ab69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19fd22c7-7633-496f-9fb9-24b3a38f5334", "sighting_of_ref": "indicator--757ef6f4-f375-474c-aaf1-ce08ce15d05d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3e41da-8f7f-4c17-b771-a56f8b315e99", "sighting_of_ref": "indicator--eaef0b84-23cf-46e5-bcc1-4a9ed7cf0007", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d84a468-dc64-49ec-872d-a4cd89850797", "sighting_of_ref": "indicator--ce424864-229d-4a45-8b2d-5493eb9ffa67", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08fdf553-cfc5-474a-b25d-5c12e361ea9f", "sighting_of_ref": "indicator--71f8ba40-184b-4ea2-8f70-98a126eb8770", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3a301af-5f03-4cf2-9640-de8214b74bb3", "sighting_of_ref": "indicator--d4e92f63-63d2-40bc-b13d-95042d77eefd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc32400a-11b8-4a1a-be94-8750df22c70c", "sighting_of_ref": "indicator--d6405354-6d40-4d3c-9703-ed52bb353f10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd0d5f2-6452-43b6-ac3c-e61bf6779837", "sighting_of_ref": "indicator--b709ee5d-dfd4-4d1f-98c8-f1fd4ea617f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab410258-b75b-4446-818d-b5d202b06825", "sighting_of_ref": "indicator--e80d764e-b967-46b8-b715-97cf57eb80fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f813ef7c-ac31-4658-8854-e63ce1572e19", "sighting_of_ref": "indicator--767713e8-5375-4879-9351-a87a399aef7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e38f93-640f-470c-ba3e-bff1bcab0163", "sighting_of_ref": "indicator--d0c797be-de71-42fc-83ac-be69580b85e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0f1e372-5ce4-4647-9411-471ab85e7b99", "sighting_of_ref": "indicator--336ec8c2-6637-4537-92a6-5b6176823af5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa9fb24e-ec3e-427c-b789-20dfc81d39dc", "sighting_of_ref": "indicator--ff80056f-1041-44b2-b1a9-ebd81e1c4b56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06ae465d-907d-4f26-9bd7-b1ce0f765bc1", "sighting_of_ref": "indicator--7b9ff36e-7a6e-41ae-84cd-aac33dfd144e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--895936a7-dac2-4d1d-b0ae-658de6bcf89b", "sighting_of_ref": "indicator--2131cf06-2d6e-4eb1-8a48-6b8b0914f968", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92398421-496a-4d1f-8d1f-4376bf42184e", "sighting_of_ref": "indicator--1ba1f2b1-6f30-42fb-af1d-f6288e881c65", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e636addd-92a5-45c1-aa45-558f294665a4", "sighting_of_ref": "indicator--89f1c316-f0e4-451a-a641-4cf4e42f113b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--675aebdc-472f-40d4-b3cf-e9dac0ea1d1e", "sighting_of_ref": "indicator--9badcf2a-0280-4788-84b3-c532d2997b6f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0234485-4bba-4693-88ad-df0b1dd4a4fd", "sighting_of_ref": "indicator--1c98995e-c34b-4d53-8b67-f5eae900751b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a10766e-c090-4eb5-8016-3491671ff3a5", "sighting_of_ref": "indicator--fc9a05f2-65f3-4c4f-8389-ebc6ea0aa214", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37e60b64-a89c-49ee-85fb-98ffaf84112b", "sighting_of_ref": "indicator--78cbf6e2-f7d7-4481-8883-fe7da6aae879", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfc3655-6121-4016-8bb3-f5095edbecc6", "sighting_of_ref": "indicator--df63f92a-2df2-4150-a8ea-fedfa5a06745", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1d3cd0f-fd5e-49cb-ba6c-dbda522379dc", "sighting_of_ref": "indicator--f2421e96-a9b4-40a5-a4d1-625dfb616b7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2fd66e6-2a9c-49a8-b666-14931f7cfb0b", "sighting_of_ref": "indicator--c598e885-f160-44b0-8526-9acd2efaf818", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0daffc40-6b37-4af1-b3b2-f3fd5f4dae6a", "sighting_of_ref": "indicator--260d50ae-4e6d-494e-920f-5a88b79ed864", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8143061-b157-4d60-b265-c3b5564f81a0", "sighting_of_ref": "indicator--aa29540a-10da-43e4-9348-7bb283be332c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc3fb22b-2a8a-48a2-ad6d-db086aff17a9", "sighting_of_ref": "indicator--a10a87e6-0614-4768-aff8-aa2f9128a1e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbf919c8-3a75-49b7-b3a5-ae20bdc27aad", "sighting_of_ref": "indicator--2d3d0e2f-76d4-45a5-8cc5-4b13f543b4ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd34735d-5c22-4233-9c56-5dc81b7f06de", "sighting_of_ref": "indicator--92da3ffb-a8ca-4628-ab5a-9c88f003a388", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47a256ee-a057-4220-b781-433720c565c3", "sighting_of_ref": "indicator--6ff3d92f-d8af-4935-89cd-6c1be6c420c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ec8f9e-e3dc-48f7-8af3-8f72eeb413ab", "sighting_of_ref": "indicator--f7830493-6b0b-43fa-8555-74535b1cda82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b80324aa-618d-4afd-bf95-cc024c79cabd", "sighting_of_ref": "indicator--a2d1a7af-19a3-48c1-903f-c9da2797774e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d7c484-b2e6-4fa7-9b22-17e08eea6636", "sighting_of_ref": "indicator--48838dc5-51cc-4993-8b26-5224979efc6f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29d14e70-9a51-459e-a964-b235ec3652c4", "sighting_of_ref": "indicator--4c5e80a6-93ef-4025-9dc5-99c78803cb73", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1fd6d4-6a6e-456f-bca1-feb1818258b1", "sighting_of_ref": "indicator--9160125a-799a-486e-9339-0c7747d04be2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25d61cc2-d715-4e58-bb24-3761b57b864a", "sighting_of_ref": "indicator--c9337178-908d-4775-ba4f-e0e6b5283137", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b8b1b3-f74d-4ca7-a377-4b4fd1e66928", "sighting_of_ref": "indicator--a45b7196-b44d-4bf4-a272-692ebadbaeb2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4299d783-b0c4-4205-ad3f-54414827ecdb", "sighting_of_ref": "indicator--c6a82e45-f752-4d5e-b0a7-601d4a36ff2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--288e9e94-4b91-4a2c-82d5-e0dfa3772aa3", "sighting_of_ref": "indicator--5875b038-6ed4-42bf-a5e8-385e1cb8bf62", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d4a07a8-bc09-4ed8-b90d-d8ec12f85a36", "sighting_of_ref": "indicator--a1e55590-7761-4a45-93e5-55be3f9fda2f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ce8f16-8331-451c-9344-7ed83fed4ff5", "sighting_of_ref": "indicator--593ef4ff-36cb-41a4-a3cf-add36e2a3612", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0882d85f-c478-4957-87f6-dbb06442ce3b", "sighting_of_ref": "indicator--7eb506d6-dadc-4b40-b0a9-ba4c87e04ec1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4689fd-4c0c-4a6a-b5f9-6fe4d7b7aec5", "sighting_of_ref": "indicator--9cea2453-ccd9-4c52-901a-fad74d81dd9b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d712fb2-d179-498f-83a6-77280ac085c2", "sighting_of_ref": "indicator--bdc0eb85-a6dd-4396-b525-15bf432448d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4307dd9-c298-4063-ba65-db152f815199", "sighting_of_ref": "indicator--aedc7708-04b9-459f-bea3-f0a71b648f3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff25ed33-ccf8-425a-9ec6-a7431d1be5f4", "sighting_of_ref": "indicator--99bf1ffb-9bea-415f-b430-c9b122ee66d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61609f02-a17a-4b1f-ba8c-3ce9ac94d85e", "sighting_of_ref": "indicator--ab816dab-e742-424b-91fb-de38059ea43f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--509554df-01db-4303-aca3-664eda6de7e4", "sighting_of_ref": "indicator--cf233e54-096c-4a61-a10a-ebf7d4058b07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c6c4a2-72c4-4754-95e3-f071d5769824", "sighting_of_ref": "indicator--a5b48159-b959-40ce-ab8a-23b47406f4d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6c2b6bc-a0de-4516-96bd-eb2e99be98a7", "sighting_of_ref": "indicator--2bc88b21-7065-4f9f-a09b-425a6e860a0e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70a83b66-5742-4fe3-9900-4411e4df2184", "sighting_of_ref": "indicator--af8de379-2a61-4a48-8c53-6bcecd14be70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10091d4c-e2ed-41db-8e5f-78ee7f17e1b8", "sighting_of_ref": "indicator--c3b2b271-e06e-402c-9a61-c55c9d78b53f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56dd0a1-ca99-4873-9b11-422db33c4a60", "sighting_of_ref": "indicator--832f186f-9a32-43a7-aefd-0b5cfc6753c4", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76e74aaf-7ba6-4ee3-a208-b1ff884c64fd", "sighting_of_ref": "indicator--6d58706f-12c8-45b1-9a9f-74c497699650", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24e37dc3-8c40-4ce1-9793-dad87ac1798f", "sighting_of_ref": "indicator--f5e3d06c-1ac5-4a21-8caf-874b5cd0a9f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a339375d-7dc2-48ad-ac16-c2765fc55c95", "sighting_of_ref": "indicator--9f162a39-3239-417b-9779-5aabd5636f92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--179c4ead-b452-451d-a52c-4e155263030e", "sighting_of_ref": "indicator--165c35d6-bf2a-49a1-a2e2-1dc3c44ba7fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8438a3ef-439c-4c73-84e9-003e68a188ce", "sighting_of_ref": "indicator--fd2196a3-aef3-42a8-90ae-d7489e08b20c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7e07fe3-3135-45fe-8241-e791c1763d91", "sighting_of_ref": "indicator--9869186b-444b-4602-b9ec-f78620c016f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c428c8f8-44be-42c4-8997-32c52c9d3a03", "sighting_of_ref": "indicator--21e782d4-9482-42e6-8542-1034eba82865", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--867049dd-ef22-4ba0-aa42-753d174c2345", "sighting_of_ref": "indicator--6771ef50-b40b-46c2-9308-3bce81768281", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41768654-678a-4d11-9680-ade8bfdf7f8e", "sighting_of_ref": "indicator--e7f49b16-0b13-41b4-9b6f-3d18b325dead", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8c7b47c-ff7e-4a52-8a0b-b0929fb8c5f9", "sighting_of_ref": "indicator--326e0ed2-25e6-4a50-beae-5f4e54f4f2ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68bdc20b-32f1-419f-9dbf-b3fac925e254", "sighting_of_ref": "indicator--0e7130e8-75ef-4f8c-ac69-7f91a7072605", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4017f375-fdd9-484f-9636-5d995b003c46", "sighting_of_ref": "indicator--7d85f26a-7287-4d80-8db1-9143a1714d22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4449c1e-9cdf-41b4-912a-2d1a5900ecb4", "sighting_of_ref": "indicator--954045b7-bde2-4dae-bae2-f44e59ae6115", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--828056a4-acce-4f71-a5e1-cb7d9e2aaef3", "sighting_of_ref": "indicator--7751ccbb-90ad-40bf-b085-9cd094805cf3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d8d457-5bb7-474e-b10b-cb0c4b91820a", "sighting_of_ref": "indicator--81ff4be7-9806-44b0-8fe7-7f5ea22193e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2f50a13-ed6c-4c7c-9e13-b86d5791b5ac", "sighting_of_ref": "indicator--ccc60bbc-c2fe-4782-b332-d4eedd8a761c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8589a362-3eb8-486f-8069-080b8bed8e27", "sighting_of_ref": "indicator--dd0f095e-a513-42d9-ba38-f2d01f92a248", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2293073-d6cc-41d3-841a-97a42634a767", "sighting_of_ref": "indicator--115becde-b9b6-425a-bb8d-3fb031107e66", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3879046d-4316-4c15-958f-d521cfb3ba18", "sighting_of_ref": "indicator--d37f562d-8834-4b2f-abda-c4c3145aeccb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef3a7185-cedc-4132-987f-0584519f5e51", "sighting_of_ref": "indicator--072d4695-432b-464b-afdc-2694377f2f66", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c48455-2f0a-49c8-82cc-c5ca0cf6e3b4", "sighting_of_ref": "indicator--cd8bd821-1316-4b87-b58b-cb5750da1118", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--358c9758-7923-4959-b47d-71b2f55fe075", "sighting_of_ref": "indicator--3c371f86-be3e-4e95-8700-03ac1083ebf3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce26d9a0-fc0e-4696-bb57-afb08fc35bbf", "sighting_of_ref": "indicator--3a8e7fad-382d-4ebf-bcc2-3e6feec411d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fdec20d-cd24-4f32-ae76-401b14e7940f", "sighting_of_ref": "indicator--4543b2b5-6dd9-40e2-8ffe-b8911c9bf8eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e895ae-0500-4cad-9744-2f0e0df69b03", "sighting_of_ref": "indicator--ec4779c8-54b8-4a3d-9bbb-db46ce1bc9f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d91da92-16dc-462a-8427-0eb554845622", "sighting_of_ref": "indicator--4ed54cd5-348d-40ce-9c71-ee50ff085714", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b8b151a-e04b-49e5-a95c-7140d1d5e849", "sighting_of_ref": "indicator--fa744e41-6f4a-4c1c-b2cf-c4c22fd83fc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2f916ce-9086-41b0-b90c-9e44f9bed42d", "sighting_of_ref": "indicator--a3f363bb-a5ee-4648-a633-5520f345403f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ee8d883-850e-4264-821d-91d0f6a93032", "sighting_of_ref": "indicator--cc363f8f-1751-40af-a1e7-2b9e4d79dc58", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a55c3de5-a201-4423-b595-c9815fa5a03e", "sighting_of_ref": "indicator--6e75f81a-d030-4753-be10-3039cf7124e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a476195e-bee5-4070-993e-0a4696f9f1fe", "sighting_of_ref": "indicator--46183d6c-6b9c-4cbf-be76-c4a96a542c39", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49d41ddf-3df1-4701-9c7d-f60239c209fe", "sighting_of_ref": "indicator--3d303334-eeda-4492-a079-e812452d1fb6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7697277-2b95-4c7b-b8ff-948e8fc87d24", "sighting_of_ref": "indicator--1ed0e76d-4341-4d53-a1c4-1178971e9fb1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aaf962c-861e-41ea-a6b4-151cba78c3e8", "sighting_of_ref": "indicator--cf902e70-3f36-400a-ad51-e2d0915e3a29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58ee1997-b357-42f8-8a5d-f298fec3e7c9", "sighting_of_ref": "indicator--569d87fd-4975-42dc-9ad9-bca0c6d77d60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48504b55-24f2-40d7-96d7-ae9b3c17860b", "sighting_of_ref": "indicator--b2379a31-9daa-432e-ac9c-0a21ad46446b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c55a99-eb6f-4769-8f95-7fe4724b24b4", "sighting_of_ref": "indicator--89e06725-920b-42ab-ab9d-59ee83acb77b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621333af-561f-4ce7-ad0d-819808da4dac", "sighting_of_ref": "indicator--5fb86acc-f9a0-4001-aaf3-cc25da1f4a40", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7782ea67-b21a-4b81-a9ed-eb994e26879a", "sighting_of_ref": "indicator--1aa45171-0540-4097-8e69-d6bb3b6fbc03", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d0e4617-629e-4f78-a458-19631e9767d7", "sighting_of_ref": "indicator--eabe9bfa-b8fd-42dc-aa70-dbf0656065c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4124e1c9-d67a-4af7-a667-6c0e4ff4034b", "sighting_of_ref": "indicator--aefe76ed-68f9-4f7d-904f-993c2c103ab0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d662e02-a7bf-4846-8d96-92eb37e85f8e", "sighting_of_ref": "indicator--64be87ca-dd4e-4983-a36a-32a7cf8aa459", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--155cd16b-dd51-482d-8409-e1caafa43627", "sighting_of_ref": "indicator--430b3c67-de1c-4ae1-929f-df5bb8749710", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2467f3-15e7-4388-93ea-b8ad51e92c7d", "sighting_of_ref": "indicator--7a3749b1-d007-41a4-ac81-09612ac12fd0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a04eae-82a1-450c-b318-44f8218af525", "sighting_of_ref": "indicator--370c6754-7df7-4cbd-a5d9-1f3ea063b0b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a56897b-51e6-463e-9203-771ea505b32c", "sighting_of_ref": "indicator--73c930cb-9c94-471b-86a7-c25d569dcdad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b56468d6-4cdf-4b00-9db1-953a391e7846", "sighting_of_ref": "indicator--c1afa71c-494a-4eee-b21e-17f3375055d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50a395b9-dec5-4e05-90b6-1ae9bca83bb6", "sighting_of_ref": "indicator--8d1f473b-68d0-4e5a-a52f-12e7429ec9a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d38a9310-3e5f-4f74-9160-e348cf8926ec", "sighting_of_ref": "indicator--5d4b8d91-3139-4c8e-b536-393e6aef94e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295cbf96-64da-4561-9bea-821127934756", "sighting_of_ref": "indicator--382586cb-87f4-4ccb-a2b0-9b1baa9d3d02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f688cfe3-9f11-4fa2-adcc-dd133a6c98c3", "sighting_of_ref": "indicator--91e2fb14-559a-45d1-bdd7-a66570728f69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7f42577-39ab-4e9a-aea9-e9bb32aaa85c", "sighting_of_ref": "indicator--c78f8c96-a2cd-4e42-8cb9-d296ef6fd200", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e494a86-9903-41d8-96c4-9fba1a304966", "sighting_of_ref": "indicator--2b534ece-d645-4115-86cc-4763721ff7f1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc3896c-20cb-4a53-b57f-6b5b80d87862", "sighting_of_ref": "indicator--696b8ee0-1e4f-4758-a43e-bebf0bf6e19c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--148eab2e-698a-4adf-a926-ce2597d1b039", "sighting_of_ref": "indicator--4427d953-2690-4328-8eaa-c5e9652746ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27aa65dd-16b1-426d-91e9-c2427df3ccbc", "sighting_of_ref": "indicator--196c1d81-2dce-4de2-914e-c83d880e7f3d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc59bbf-84cf-4efa-9b85-15fdc150a38b", "sighting_of_ref": "indicator--91213658-10d5-44d3-8404-5200d3844fb6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd8080a1-d891-4666-98bc-863be923b98a", "sighting_of_ref": "indicator--ff0f9040-c528-4e3b-9d63-8e13006afd49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--484b915a-8cce-4067-8f74-09eae4b468b5", "sighting_of_ref": "indicator--f11d29ea-3804-4ec1-8f64-1ab79d50c34c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035bc1a3-0ae7-410d-b147-74e9489a99aa", "sighting_of_ref": "indicator--372415e0-069e-4d6c-8cbb-e9cd1bc00746", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17085052-8c64-482a-98f2-7bc0b9c81345", "sighting_of_ref": "indicator--9a9bee84-b69f-4cd5-9948-14bc3ffd333f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8fe16e-3e3d-458c-91ff-ed41ce6a091a", "sighting_of_ref": "indicator--36233ba2-39ca-4d08-8157-e275764c23d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--745988e6-23cc-4160-a01d-231c83d3d504", "sighting_of_ref": "indicator--84d07885-0879-432d-abf3-276ac9864403", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7184625-fcee-4056-b16e-3dc03a4ce4f5", "sighting_of_ref": "indicator--ffd021ed-b38b-43e5-9cd3-ce3c599e58d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87b7fe61-719f-4063-94fa-352f7f6e76c0", "sighting_of_ref": "indicator--dfde6b8d-4b74-4965-8a30-dc6f7e91a2ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66e33a73-123e-4a65-a1d6-5f5ea478967b", "sighting_of_ref": "indicator--99f49193-fb6e-435b-a999-f69a90d7e28f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9be023d-c85c-4af5-a637-6b36178b717f", "sighting_of_ref": "indicator--5b1c343d-1f57-41dc-ad12-7ad4cf19ebda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b929ab-8a7d-4c38-b180-afbfd16952b6", "sighting_of_ref": "indicator--9d5b07f1-57c0-48d1-aaa7-0b70de68220a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35310647-b8a6-4346-98a2-9b98bf9b191b", "sighting_of_ref": "indicator--83a39c97-97d7-487b-b816-c99b83929e4d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01d2fa21-a97f-40c6-8d0c-f52e0fdd9688", "sighting_of_ref": "indicator--5734260d-e7b8-405f-86d9-13e575ff1a01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fec72b87-bb3c-4c12-8085-bbb3c415cb47", "sighting_of_ref": "indicator--b2130195-6e62-471b-8e94-55fbc99661bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b4dbe2-d9ba-451d-bc28-b27f82909312", "sighting_of_ref": "indicator--1ebccfc7-191f-49c2-81a1-7fba575a04bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e656cddf-9541-46e0-9459-fae05ae3beb1", "sighting_of_ref": "indicator--c84842ac-c213-4c3e-9689-427aac489536", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82794c0e-edda-4ef8-ba1e-3810117f418d", "sighting_of_ref": "indicator--d7fc4b41-50f0-4b97-996e-735650e2859f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4662676-0136-477d-903b-82b2e2b3077d", "sighting_of_ref": "indicator--28d1eca7-0b14-4a3c-a6cb-71d668146be0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c403a75b-bcef-43fd-b21b-785e86a670df", "sighting_of_ref": "indicator--ca5412fe-db53-4f66-8267-234b8e51314f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad67e753-bf60-48d7-81bb-2d90bea0dab1", "sighting_of_ref": "indicator--d25b8613-4436-4699-9442-a0b2713d35e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035e4e53-fa18-43e1-bc09-b95e537bc54b", "sighting_of_ref": "indicator--69440be9-69d4-4fe1-aee3-73310a4eeae5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3a7024-b897-49d6-9d5b-bee360fe8cb3", "sighting_of_ref": "indicator--1af27a3e-8b14-4bbd-8919-098b94fb9439", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6d373ab-f79b-4e8b-baa1-3e54689c15c5", "sighting_of_ref": "indicator--db0b4a57-d477-466a-8231-6b2b7f655805", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acc1cfd2-5b99-4551-b9f5-f6eef9ed86cd", "sighting_of_ref": "indicator--cbc7373c-33f2-48ae-9162-596a0260cddb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9062d44b-f66d-41e4-9a1c-98b907ad116e", "sighting_of_ref": "indicator--dc033d71-1400-4020-ad28-20f4859f27a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f89136e-a0ef-4f02-a9fd-c72ed733608c", "sighting_of_ref": "indicator--2135f74c-10b2-4888-ab40-775f96de9215", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8292f5ba-111b-452d-a26a-ab9511664f73", "sighting_of_ref": "indicator--ab6ad826-2084-4096-91a0-0bcd14ae10ae", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe770cfd-fa67-470a-a94a-6fdf75dc8cf1", "sighting_of_ref": "indicator--f7959916-6dc2-4f1a-a768-d9e3c9285d60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2caad35b-3567-4076-ba75-b8c4ffb553dd", "sighting_of_ref": "indicator--8131c2bc-fdfe-4405-a46d-205315ea1b89", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8dfa5b9-db17-4859-a6cc-93087d75a7c4", "sighting_of_ref": "indicator--559528d3-092f-4973-b589-c47ecdbca595", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cd31b85-b6ec-45ee-ad1a-f3bf6bc1e052", "sighting_of_ref": "indicator--3d50eb55-f71d-47ff-8f7e-0a5556a58465", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e30da3d-d6fb-42c7-a5f9-f896b992d77d", "sighting_of_ref": "indicator--6bccb7c9-a437-49fd-908a-6ba58ae724c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14bd077b-1d5e-4d71-a2af-80bbea044c09", "sighting_of_ref": "indicator--edf3bd2d-0d2d-43f2-a168-fd51a6987123", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42b61b1-a96e-427f-8779-a11f30d77c2a", "sighting_of_ref": "indicator--5018ca88-5504-4c91-b624-29ad91af7edd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ca5cfa5-5ef5-4e73-afbd-bd5f7875cdae", "sighting_of_ref": "indicator--ddd8ccb7-8338-45e6-a858-ff1f7725e8e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3c2f767-5b75-4218-8568-5a23ac3a259f", "sighting_of_ref": "indicator--1d76ac84-476a-4c55-a98e-0077df5120a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd982bb-b159-4741-b367-0ccbd825b2ca", "sighting_of_ref": "indicator--212e2b4d-64b7-4c08-ae5f-30ed58f3a470", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bcc4732-a2ca-4166-8820-98bb7d3c2d38", "sighting_of_ref": "indicator--c9089cec-66f0-427f-8c82-b79d44ee7eda", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20684d71-83d2-4ab7-ab51-1e845e64658c", "sighting_of_ref": "indicator--9a5a344a-215d-4c74-bac1-06198fd0f909", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f77ffc-a0f2-4fc2-adca-531b8bf9a136", "sighting_of_ref": "indicator--ae9463ad-70a8-4ff1-b82e-bdaf565ac14d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab0973a-96b7-4962-8219-6adadaffbd30", "sighting_of_ref": "indicator--a053fbfc-2969-4b32-8d49-6b5ee140295d", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4ca861b-a20d-4f03-90fa-2df3dcdd3c53", "sighting_of_ref": "indicator--993c0b31-7164-4281-a5c7-47438ab5c58a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dfbdc35-1737-4d36-a584-1cfe560da4db", "sighting_of_ref": "indicator--190d329c-8f15-43be-9bd2-d2e01250b6dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--831de8df-7dc2-44aa-9208-2f9d5fd948b3", "sighting_of_ref": "indicator--a9404219-e5b9-481d-8833-1b173ec96b20", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4d5d678-87aa-40e6-938e-552fd16474ec", "sighting_of_ref": "indicator--19570576-ed74-4775-b3d6-1ade562a6db2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb4d77f2-5bde-472d-b574-e9c1b180e427", "sighting_of_ref": "indicator--d0383a65-a23b-4f94-851a-e524e875fbc1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33162966-5bb1-4948-bc49-f1261a883b0a", "sighting_of_ref": "indicator--ed03bedd-c204-4032-bd86-9ed91d6d0a1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcc2c55a-5e43-4ea1-b148-46a653d1ffe4", "sighting_of_ref": "indicator--dafcd5d8-d1cf-4aa3-9a0b-7181c7138f3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1b07553-b75b-421b-83b5-e162233a3fe9", "sighting_of_ref": "indicator--be92e537-b24f-4a67-9251-2c7305965419", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943ae0a2-2ff1-4067-854f-6e0a8f19e3dc", "sighting_of_ref": "indicator--f7d0dcc9-d74d-4845-8099-a7b00b8d43f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29fef0d2-94a3-4cfe-82d2-65581eaa2932", "sighting_of_ref": "indicator--26fa7c01-d9c7-467b-bcda-036a9ad16ecd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3055ddf0-69e8-4318-8c17-728c55e1ef2f", "sighting_of_ref": "indicator--87c80548-57c9-4f5b-8bd7-f30f3f163b59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38f32aa-6c78-4a59-a657-79a4ab26ff3c", "sighting_of_ref": "indicator--252e39f3-98fb-434c-80c6-eb7593916057", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2afdb9-682a-41e2-a798-7176eb8b7420", "sighting_of_ref": "indicator--da23bb64-f1cf-47ab-ab7a-3ba445460012", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d99a3f0-22cb-49e9-af72-f8620ed680ec", "sighting_of_ref": "indicator--d9254050-8035-4367-9b65-a0f408df0f42", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18c47b16-b315-4de0-b3cb-5781836ec233", "sighting_of_ref": "indicator--eca301b4-d029-4406-bebb-afe39f59c0c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2809d55b-0b49-4f53-b0e5-884e4dfae0ee", "sighting_of_ref": "indicator--7a58afd4-1f49-4ce9-9f5c-e668dde3bba6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2c0ff3f-68d7-4b28-9e49-96888df8bed5", "sighting_of_ref": "indicator--79338cfe-a473-4793-b757-40a54eb7eb4a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1563e0f-46a0-406b-897a-c6e65903f201", "sighting_of_ref": "indicator--93f159b8-f893-4cad-878e-09285c842376", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955e69e8-1f25-463a-bb28-9df4ae6afc0a", "sighting_of_ref": "indicator--e8b350e3-494b-417e-935d-bf7e5ad0c45f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458edec0-f076-4ed0-b98b-60ccc3ea056d", "sighting_of_ref": "indicator--bae6df6d-8920-4fb8-aa4f-a80d17f42645", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7b1dff-d858-49e3-9621-478d9449da80", "sighting_of_ref": "indicator--41f33c5a-55fc-427f-b47a-0bde6c5b6ab8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c0b9a91-1168-467b-9fef-f9c728160c55", "sighting_of_ref": "indicator--276daa85-5fca-4940-85a8-d77b1698713d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f36f91d7-383d-4949-8ceb-0a92c9351835", "sighting_of_ref": "indicator--c41b3a83-d009-4b1d-8a44-8267128d3d67", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0feaabe0-77d5-451e-a876-f40a98b3e206", "sighting_of_ref": "indicator--555232d8-c04a-43dd-b7b2-5fda010796ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98719a77-c5d3-445e-8a9b-4de7b11e11c4", "sighting_of_ref": "indicator--b88463b6-18da-4df6-a0d4-f4910b81cc85", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e136fea-07ec-4037-a494-d74c47229e4f", "sighting_of_ref": "indicator--ad1486f4-45e7-436a-8248-aaecd8c7d34b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6343def8-c917-46c7-a526-580378dbc407", "sighting_of_ref": "indicator--82b4d296-cb94-42e7-a128-3f82aa6f856e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6abc08d3-fb51-4a34-b221-4d87c479acc9", "sighting_of_ref": "indicator--13d1b069-5a93-466a-8f8d-d7eb7af4f619", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b331598-a7de-45a9-b416-531c15f92c11", "sighting_of_ref": "indicator--a22c83e0-6f07-4a9c-8ea9-f7d53f4e860a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17eba9c1-8631-41e0-a96d-0418c1f2f547", "sighting_of_ref": "indicator--5749fd83-0040-4129-bff7-7c9f7000e7ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8c9a9b8-0041-4350-81d6-be7a656ed512", "sighting_of_ref": "indicator--0a39d66f-b7ca-451e-8705-61b07e7e7fd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--075dba66-9380-446c-86ea-05532e99e16d", "sighting_of_ref": "indicator--6b2dbce7-8f41-4a2c-a9f3-8043d35042cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cad1b3c-a895-45c5-b0a6-63685b3cc8d9", "sighting_of_ref": "indicator--3b230191-37e8-41ec-828e-57af8ed212de", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02cf252-df54-43b2-af82-ee07c6af06d1", "sighting_of_ref": "indicator--111bdf0f-7aba-4a07-8445-980789478985", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37274851-91b9-4234-b2f4-b3a240113e52", "sighting_of_ref": "indicator--67ece8fa-09b0-4335-a9d0-481381c72c09", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--851349a0-5dee-45fe-a8e0-ef85f8eace40", "sighting_of_ref": "indicator--c57a0496-1f94-42c5-bb1e-d1c8b29baf0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a33eda-e349-4317-b465-c7d6f8d8a690", "sighting_of_ref": "indicator--84bb5e01-314b-4585-8a7a-944841b52615", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--328d5bf2-070b-4562-add9-cae3e8c9c274", "sighting_of_ref": "indicator--61652223-7a6f-49fd-ac93-212610522fe7", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86044988-5890-4828-b620-b48a9e15670f", "sighting_of_ref": "indicator--f003a67a-0e3c-41b9-bae8-1b47e7fe4d46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a16d682-205f-48b5-845e-b893aa9c4475", "sighting_of_ref": "indicator--84c092c2-b901-4abd-9145-a759516b1524", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--639fdd2b-b51d-482e-a2f6-ef062923c7da", "sighting_of_ref": "indicator--dfcc49ce-28bb-4e2e-80c7-fe7d5926d996", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5908db96-860e-4461-a86c-7df68186d3bb", "sighting_of_ref": "indicator--4374f0ba-d9ca-42fd-a28d-21eb54573817", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--096c3fb0-dd04-4b1e-8957-ce137dfc810e", "sighting_of_ref": "indicator--e3e88b27-5d99-438a-b565-13c09e8ba257", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2056194e-b1d2-4f40-8418-5bc9447ef73c", "sighting_of_ref": "indicator--15f04675-4f74-4c92-a2da-92349390711c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af395f4e-1986-48f6-8452-a37d82b2f84d", "sighting_of_ref": "indicator--c3bbc729-6b33-425c-b68f-e37239cdbcee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9ecc9b2-a436-4b72-9544-357a6d635814", "sighting_of_ref": "indicator--f2b0f528-41f1-4a7a-aa0b-de6e693472cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc046f77-6ae0-453e-bc70-a1a10e5f9e35", "sighting_of_ref": "indicator--41157a92-0b2e-4f01-bb4b-78d302a83d14", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3052ea56-7e1a-4751-9c07-302238f0288a", "sighting_of_ref": "indicator--22473382-8770-4425-989d-3b7468a64410", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb083589-d437-4eb3-8d72-ef3a733bffca", "sighting_of_ref": "indicator--73518d88-2467-4c8c-af58-e8e4b44cec7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ce2f52c-7281-4877-8658-d972c61e2024", "sighting_of_ref": "indicator--cba2d799-285f-4cba-9d62-bf8248dbcff1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a118e47c-14d6-434c-bde6-be8d1594e5ec", "sighting_of_ref": "indicator--01ed4fe7-ab0d-4410-9cc5-3de6738cab36", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8154e2a-5984-4f61-9dd8-a9ba67461556", "sighting_of_ref": "indicator--cfd99216-eb64-4654-964f-75efa84d1844", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e00a006-6831-4132-bca6-cb7083ea621c", "sighting_of_ref": "indicator--ff598894-2553-4278-91c3-7db9a4e34dcb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2228d98a-1a8e-41a4-95cc-b07282c21799", "sighting_of_ref": "indicator--5808ab5f-444b-4404-a05e-3b902412bb82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9d4a21-d9c8-4766-9de2-e91f4dfb299c", "sighting_of_ref": "indicator--61eecf2f-874b-4f15-89f3-802bdb3ba9cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a8139de-8d85-456b-a9f0-2e1a770656fb", "sighting_of_ref": "indicator--7ebd54a8-b628-442b-87dc-7c3e42c8d634", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d1c8684-1750-4fae-86a8-898f755ccf41", "sighting_of_ref": "indicator--93b3de0b-ef95-4b27-97ee-2fa884f26ddb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32f2513e-5027-4222-9692-923f71ca778f", "sighting_of_ref": "indicator--b45e740c-7430-4b8f-9c11-0301085213a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72d805bc-ff12-4a09-873c-67ae8d0263c9", "sighting_of_ref": "indicator--0713ad38-07b1-42b5-b62a-8c2077ef5424", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5a23657-0284-4b39-b276-7024ff3374bf", "sighting_of_ref": "indicator--b55ec76c-ca62-46df-bb3c-16c14c723950", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e595794-0106-4abe-9b97-78ef9d0a434e", "sighting_of_ref": "indicator--7fac037b-4fe9-4aab-a9da-32e30b8c9eb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca4aa0dc-f769-4bcc-9aac-6e7f82153cbe", "sighting_of_ref": "indicator--eafb69cd-720f-44ec-8be7-cad2b72ebcd6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f12eafdf-3b02-4d9d-964d-effd79871474", "sighting_of_ref": "indicator--43f5b0ea-f189-408e-b42d-2630ba49e987", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4547169-4a00-49f6-b367-deb01798faf3", "sighting_of_ref": "indicator--455339c7-eaae-4eaf-beb4-70138ac9dbd2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a84c68-161b-4147-9556-cdf63d4f99ee", "sighting_of_ref": "indicator--e7937e7f-3f54-4c1b-b11f-dd727638d542", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57e9a1db-b5f7-46ff-b38a-3d5bef9dccf1", "sighting_of_ref": "indicator--da66cdb7-1252-4343-8f28-89d68900fe77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cb4755c-b94d-442d-982e-8a746470737c", "sighting_of_ref": "indicator--3ea14ae4-51f1-4f1c-aad0-65c75a6f9dd6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8180f381-9adc-4d1d-898b-0ab9c96cff4f", "sighting_of_ref": "indicator--cc406e27-e26d-4cff-ae6e-c75610c27df3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d97496d-ddcd-474f-a5df-1c075822c5c1", "sighting_of_ref": "indicator--5e01a99e-4812-4ab9-b4f1-91d20c8a09d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dad50e9-0093-4787-9fe9-5bc39889f206", "sighting_of_ref": "indicator--3c7b4adc-8cf1-49ab-b454-6eab7c339331", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30979b8f-d968-4faf-b4da-c8be5f087faf", "sighting_of_ref": "indicator--9345b21c-79ed-4cb1-b158-dc4f5cf45e7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d37af08-954a-49b0-8f90-4fbc2f7db5aa", "sighting_of_ref": "indicator--e603d165-a893-4c94-82f1-1260806be7d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9574e50-ebdb-4e96-979c-6d8ba9da7558", "sighting_of_ref": "indicator--e741f154-e00a-4a0c-9861-16f2b0c1593f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325b7479-f6a7-4776-add0-c508d1481b58", "sighting_of_ref": "indicator--8e4936e2-4800-4805-bfad-83020bc3d9c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfe9202d-5e13-48be-a76f-8ad6d085c374", "sighting_of_ref": "indicator--af4da165-1935-4545-8086-edc177fe8379", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b846d58d-1747-4a58-bff7-10156f1e2e08", "sighting_of_ref": "indicator--c8a6e988-e845-40ce-a439-60f1aa870442", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b41f16e5-3ea3-4a00-bd93-1b9aaddf43a2", "sighting_of_ref": "indicator--2a9c127d-b956-4885-acc9-4b1362a8675f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc112556-0840-46ce-9a36-3ef9e9b86563", "sighting_of_ref": "indicator--8f24fd8e-08fa-40c8-a11f-51112ee5598b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bb07916-cce9-4132-8cb6-aeb25919630b", "sighting_of_ref": "indicator--cf960c85-caa6-404b-94d9-9a9568428608", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8901ca60-b222-46b1-86a6-03188b8dbd90", "sighting_of_ref": "indicator--962276d0-c60c-4293-a80e-079361a94c3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dba63c4-25de-43e4-acda-a4b5462ce67b", "sighting_of_ref": "indicator--dec9af2e-9f86-46f8-8434-302488287a94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86123de4-e63a-472e-accd-31dbd6e5d5fe", "sighting_of_ref": "indicator--80ff6c08-d3f7-49fa-b477-47e05bb22e84", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5930b4-2944-499b-940d-5cc851ea4201", "sighting_of_ref": "indicator--7beb0a25-7426-49c1-9efd-c3411aa60c46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cecec45-2df2-484f-9586-4a1d3693c645", "sighting_of_ref": "indicator--0e725ebc-80e5-4a41-8512-3a17e21d6cf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47d8b7a-34db-450a-bea4-309859f013d8", "sighting_of_ref": "indicator--07c915dd-5cd0-41d2-bf0a-889ee1754a7c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccd8a03b-9622-47f0-8679-0226ae9f494e", "sighting_of_ref": "indicator--23257de8-d4f9-490c-8544-5fdc521ea86a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b04c9ef-ee91-4622-bf37-933ecd69c4f0", "sighting_of_ref": "indicator--ebf920e4-1c11-4cd1-b0f1-37e1e610ad22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9752bfd-e1e5-49de-8f21-9adc9e5fb650", "sighting_of_ref": "indicator--a5f45cd2-f12f-4f99-8db8-c8fd8cf10e9d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e415f6c-bf29-4e38-a0b3-1d6a8e6f9b94", "sighting_of_ref": "indicator--1be7f1c2-017c-4b34-9769-5402446996c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6bf0450-fe00-4ab3-a9b9-f0b17237c8d1", "sighting_of_ref": "indicator--a5884c39-40d2-4109-9d04-8f022f209c3a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1653716-1fca-4146-8c0b-a49ccd945e33", "sighting_of_ref": "indicator--de209ea9-983f-4562-9c3b-6629a06e4a11", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67bcfff4-4e35-4f8e-ab2c-3c4e8d97003a", "sighting_of_ref": "indicator--b590546c-4d75-4cb8-9994-6b321bc0f841", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6192a3-3779-4a32-b6e3-72f04837126c", "sighting_of_ref": "indicator--33fd94d9-25a8-4537-8c51-852f836e2ce8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6291824d-62a0-4a1b-bfa8-dfb158e7cc9c", "sighting_of_ref": "indicator--f8500db1-0271-4ad0-a366-48b0965bb7e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644fe351-9bbc-4f5f-85f2-5cbfc2766a4f", "sighting_of_ref": "indicator--7df563a1-dd19-4d52-8658-5017aeff376e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3194b94f-48bf-41f1-bd5c-b14300cc4e36", "sighting_of_ref": "indicator--283c9a9d-397b-4d1b-9b19-21841b65d903", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c1dad9b-d63e-451e-ba26-0baf646eba1d", "sighting_of_ref": "indicator--16686b31-e8bb-42b9-be41-53d9676b7e0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a3d889-23f3-4cbe-a94b-fa37edc3920f", "sighting_of_ref": "indicator--b53544a2-55ca-4954-af20-17eaf1c472ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e88641d-9ce1-4eb6-93fc-c8ab8da6ff0b", "sighting_of_ref": "indicator--2a038407-abb0-4671-a17f-185e1013b32d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--114f0d5c-ecb9-473a-a499-5ef9e8d6403e", "sighting_of_ref": "indicator--6ae83d0e-3bf7-4e7a-a626-279ef55cb37a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a70455d-5efd-4c52-bd83-e35067746a8d", "sighting_of_ref": "indicator--99b856c3-5b78-4efb-a9d6-0d19771e94b8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cc47422-32bc-4059-9ce5-f10d888d74f0", "sighting_of_ref": "indicator--76b456c5-2056-4ace-83c0-5c801dc5c661", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59d9b49b-2d1e-491d-9002-86a0cf8912d5", "sighting_of_ref": "indicator--d7e785b9-78c8-46ce-83ec-0d4f9f34bfc9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a99b4c7-a21f-4c0d-809e-64be7d094e21", "sighting_of_ref": "indicator--8a1c6016-8e75-4f2d-9d86-a50a4b7d1982", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6922d25d-1530-4e11-9764-9e728b5d27db", "sighting_of_ref": "indicator--4aad9ba9-adfe-41f5-8862-c467cd9b8b69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4acd98db-b254-4997-9f88-1d8e2a7a49b6", "sighting_of_ref": "indicator--8bd31e5d-8e32-4426-8aff-445fd0931f71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b34e4da5-25ed-418a-af00-36fcb7cfb9a1", "sighting_of_ref": "indicator--09e6c93e-2ea8-4393-a585-e2cc8c89fe1e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19e12cf2-d970-47d7-bc60-ba75d71df545", "sighting_of_ref": "indicator--98d8701d-0720-4490-98aa-cd1da906f0d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f662f2c5-16c9-4f18-b057-8ca993aae730", "sighting_of_ref": "indicator--ff79b53b-3d3b-4c01-9d1a-49e67ab005a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14f15d30-9b35-4a77-92ba-b0ebb97f8ad7", "sighting_of_ref": "indicator--c69522d5-5365-4836-8e98-7eabeb76b7d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a711ac-5ba4-4a3f-a24b-0da427d3fcba", "sighting_of_ref": "indicator--1732fe29-c78e-41b7-b61a-47fc3ec65759", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14f7c2be-3c08-417d-a178-38b2f1a02edb", "sighting_of_ref": "indicator--e06d9cd2-67bd-4243-824d-040e66ec4ae8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb274ac-f123-49b8-9a4c-4ed8f32f677a", "sighting_of_ref": "indicator--f43e8ded-a5e4-476f-9837-59cfb7477e52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd1d4d07-ac17-4fb5-8c1b-b88084508297", "sighting_of_ref": "indicator--73363de4-a4b2-4fc7-bb23-7c33250297ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c089d2b-6955-4cdd-99b5-7cefcea1a4e2", "sighting_of_ref": "indicator--8568442f-bfdd-4491-b884-78f676987530", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0abce7f9-2b9b-4cf7-a019-76a017c5f004", "sighting_of_ref": "indicator--7ed05baf-af72-40c9-8120-4140be035a28", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--842850a5-5882-4286-a2fb-aa5f25a71cb3", "sighting_of_ref": "indicator--bb96aae6-b2e1-45c1-8d5f-c029e284448a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49ff4420-f2cb-4c42-81a5-028513fd1b4c", "sighting_of_ref": "indicator--603a49d7-2067-44a5-a816-b9350987bf39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46341fd-d677-4df3-af70-a4f58379b03a", "sighting_of_ref": "indicator--0c26705d-d3fe-4c13-a1cd-4c077d5b2de8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca00d5b-5447-4a88-86b8-91fa0fa39370", "sighting_of_ref": "indicator--22155cb7-45f7-464e-b254-9dd6795ef963", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea983850-aafc-44b2-b11d-061fda01676b", "sighting_of_ref": "indicator--82c22417-231a-4de5-9ea8-fb3d12241b96", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--167443a0-42d7-4cd0-89c5-8ab42f58ef1d", "sighting_of_ref": "indicator--7b06edbe-12c0-4707-a01d-ac27691dfb95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99466c1e-56d8-44d8-8659-e098e4555f86", "sighting_of_ref": "indicator--c3d0fd4b-927b-4d1a-916b-cd324d03c52b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abd94a61-80d6-4c0b-a226-9d0b96e17a3f", "sighting_of_ref": "indicator--9cf47fba-b8e3-477f-8bcc-9a4529ba9bae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da43eae9-4a66-4154-83a1-c8acba738d75", "sighting_of_ref": "indicator--f8bd7783-22de-4f74-8922-00e709378c7c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce038285-0064-4806-879b-853b407096d8", "sighting_of_ref": "indicator--4bacfbcb-5a76-4468-8900-7d94a5e855e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0884c8e-1f23-4800-a29f-1b294eba1438", "sighting_of_ref": "indicator--1ee35cb1-0694-4281-8b8e-1d8a60c65b63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd041b6-e829-464e-825b-ce2d1499056d", "sighting_of_ref": "indicator--7f7a4f25-2d9f-4624-85a0-f95789abff47", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7114d91-5da8-4b63-886e-4f82cb7ef492", "sighting_of_ref": "indicator--c046ab39-3e2d-4700-a609-2aea81ff5e07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08bc3394-6cb4-4bd3-ab13-d184bff53685", "sighting_of_ref": "indicator--a98af2b7-91ba-4682-9974-c97391c9869e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fee27d0-de3f-4a94-8cc7-191b5ad3ba75", "sighting_of_ref": "indicator--8415e9a2-1068-48e2-9e8d-3c4c8620f23a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a1409dc-0d82-4cd8-8b23-8bd10e1fa140", "sighting_of_ref": "indicator--493ed34b-2875-4b85-8f3f-4638b5946321", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c6c3895-d675-4cce-9f0b-f76c08ca22e7", "sighting_of_ref": "indicator--22f67053-fa28-4f75-a3fa-6fbb02c61acf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed7b616-fd97-4057-848f-5f16fb27ea6e", "sighting_of_ref": "indicator--1e798526-776b-4ef3-a5b4-44da2ee32ae8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--915900e7-bc0c-4f07-b0cc-8303ee1b7f86", "sighting_of_ref": "indicator--d22e6f11-fb9d-4fe7-8af6-2578d3780d5e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--702839e0-340c-48c5-949e-dc2c7cbede33", "sighting_of_ref": "indicator--2e3e8106-0d06-4685-98d3-9ff40a27dcda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1943243a-d03a-4c51-9bcc-690b1397b1e4", "sighting_of_ref": "indicator--80a29a66-94f4-4a94-bf59-81b45f0a877c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cec278a-4575-45fc-8f98-5fff94432023", "sighting_of_ref": "indicator--f9e15abe-3ca1-4e84-abd2-fc49e7b069cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e69964a1-e16b-4a76-aaac-36d8ce6a7dad", "sighting_of_ref": "indicator--7a4094ce-f976-41e1-9804-7c148b40d0fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30e2cca5-ed3d-4907-b218-f58f98d58b9a", "sighting_of_ref": "indicator--e633446f-f3ec-42dd-bed4-e74e3e2b973b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74bca9b4-6f94-488b-9fa8-0282d1083731", "sighting_of_ref": "indicator--98d518aa-ad63-40d5-82c6-fee5f1c402d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e25869-1d41-414a-b409-0aff7e12e1c1", "sighting_of_ref": "indicator--a06164a8-4cf8-4859-a787-d08685883996", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dec90e7-fbd0-4660-89d1-1e3405561283", "sighting_of_ref": "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb8882a1-bfa6-4353-a1ff-451b4f146c81", "sighting_of_ref": "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3df7967c-cb1b-4f8a-b6c1-d37b2ef8ffe8", "sighting_of_ref": "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65bba965-99da-453a-a282-97b1f495ac7e", "sighting_of_ref": "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--285beb3b-4283-4d14-9db8-2bf8de64aa52", "sighting_of_ref": "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b5a718-b8a7-4412-83a0-a6142d38feb5", "sighting_of_ref": "indicator--59a8f481-ea00-4ad4-802c-fdf507a0bd53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1d73ef-a64a-4e44-9bfb-ad23c3ac4fa3", "sighting_of_ref": "indicator--24327486-3467-424e-8e5a-2161c629f355", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913ee211-d4b8-422e-9756-af15712a3f95", "sighting_of_ref": "indicator--b028f50d-c43f-48bf-a98d-281877ccd034", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a461e937-eace-4afb-bbae-c00c46d2b1ea", "sighting_of_ref": "indicator--56c114df-ad4f-40cb-8c4c-7b99d746b460", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2f9dde-ea6d-4ee9-968d-9dcf38e03c6c", "sighting_of_ref": "indicator--a9f8c9e7-e73a-4dfc-9c1a-7badef5e1776", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--323f1ec2-fb55-4830-8bf7-820eee7ec55a", "sighting_of_ref": "indicator--19cadae5-d175-4c3b-8f37-4a69e05b6069", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--848b0cce-c818-4d4b-8dc9-3033d6119327", "sighting_of_ref": "indicator--a8825ad9-644f-4d5b-bb12-2056d21335a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe784184-4233-4aa2-a58a-4bf170e1fff6", "sighting_of_ref": "indicator--c60b805a-3521-4498-9b76-8ef6d7f12a66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b820c10b-c3bb-499e-bc47-5d650aaf32d3", "sighting_of_ref": "indicator--5b51bba8-fc98-4342-ae91-af32d0209e7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f335695-9fe8-413d-8b8f-19cd9001288f", "sighting_of_ref": "indicator--94025145-e0ac-4a2d-a3a5-1d3cd616e74b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba1cd61-8a84-4989-a54e-7cfdb655b62d", "sighting_of_ref": "indicator--66edf3f1-9995-42d7-8191-700b53f3a4a5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5c6c4b-218c-4865-870c-4cfe75d9fedc", "sighting_of_ref": "indicator--21bd588f-58a8-4327-9a47-511f4b158f30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b49368-c26f-4084-8fd0-7fa9ad0b884f", "sighting_of_ref": "indicator--3eddfb00-14cc-45ee-ae0c-76f0198d4a50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6dbec2-bbbb-4150-94e9-f036c869e50c", "sighting_of_ref": "indicator--a4a2e4e0-45e2-4445-bdd2-7a88914b14d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d97ba02-085c-4b88-8f76-7a68a06ab2ae", "sighting_of_ref": "indicator--c62ef264-56d1-4fdc-bd41-3bd3dafe326a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d9d276-4724-44a1-b8fb-1a05da480e10", "sighting_of_ref": "indicator--8b1bdec3-8941-4098-9478-8100c93e3183", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7afdbb-192a-4610-b81b-b8b00045f061", "sighting_of_ref": "indicator--20c6e1e4-41a6-45a7-b015-102536a97eb2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f373128-d430-44e5-a4c5-b81c395daf7b", "sighting_of_ref": "indicator--ae4d4217-76d9-4099-9669-7ee515103a08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97a9aa21-f4f7-41c6-a5de-7270c40cac17", "sighting_of_ref": "indicator--f9045a17-cb22-45d2-888b-70477accec69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ab36e87-400d-4f68-b022-eb0bdafa57d9", "sighting_of_ref": "indicator--61a85514-f298-4f79-a710-365bdb60c066", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f50a85d1-0465-42f0-969c-7cf999fe48f1", "sighting_of_ref": "indicator--8ff319c9-808a-4bb7-8ce9-aadf695ed80c", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5101a85-aeba-4454-845e-82ca694a6020", "sighting_of_ref": "indicator--53cdb68e-0ff6-4faf-a329-8a5b4936f003", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31699991-554e-4f31-a3cb-e724b15c42d9", "sighting_of_ref": "indicator--8565fe24-c941-4daa-9b37-b064bb1c895b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e67d77-4217-4432-a8e1-99ef17c6ca8e", "sighting_of_ref": "indicator--d3843685-56cd-4a30-a92d-071cdfa9126a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447c9063-6338-4734-a916-51488d577fd7", "sighting_of_ref": "indicator--d26adbe0-dba4-41d1-89e4-76ab26a3cf38", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2801a03d-4836-497b-b064-797120f76df5", "sighting_of_ref": "indicator--7a56571d-8119-498e-b565-f6944300f2e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--567ab754-3228-45bc-a51b-4beefc8f31a9", "sighting_of_ref": "indicator--e714ca39-6953-47f7-a0c9-1d12b4d44f49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325079b4-2c2c-429f-80bc-96fd6fba66de", "sighting_of_ref": "indicator--9bc5b6cf-256a-4890-82f7-fb1558a26dc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--660ff96b-e396-4220-a91a-da157eee5b47", "sighting_of_ref": "indicator--0eb8a59b-5d8d-4723-87ee-558adcd2c39f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90f1114-dc1a-4878-b55d-ff03fb7f18f7", "sighting_of_ref": "indicator--faa9d69c-9192-4d35-9a30-35fa8326afd0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c949f56-0afa-4c51-8568-de110961de5a", "sighting_of_ref": "indicator--8c59c27f-78f7-48ae-8229-0bfb4a702696", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86c51c0d-ba2f-464b-a9c0-fea98c5292be", "sighting_of_ref": "indicator--3aa6a841-e27d-4d2b-99e2-ba6a1c8f1892", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5df273-ec44-4110-8be6-efdd83afb45a", "sighting_of_ref": "indicator--542073f1-d875-478a-adc4-e82d8324fdd9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9745cf1-1ab3-498f-8771-bb701c2cd1f3", "sighting_of_ref": "indicator--0b08d9e3-d724-4864-91e3-2e07d3b5afb6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05cba53-9e4d-4624-bb56-18947457b5a3", "sighting_of_ref": "indicator--0a580e1f-54e4-421b-b4f0-9b55d15ab307", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d46d033-f039-4698-aac5-6a1ac2886326", "sighting_of_ref": "indicator--3cd726da-2e23-4d21-b248-89c071a7a435", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--314f2617-7263-4eff-9074-619690f29105", "sighting_of_ref": "indicator--4e077a3f-ffd6-4d49-a09a-3996af640599", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1a2eb7-df37-40e6-a4d5-16eb4df7132a", "sighting_of_ref": "indicator--e7a34284-2a2f-4a81-ba3e-87f870c290cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb17a1b2-f557-4316-b62f-10f6be3280dd", "sighting_of_ref": "indicator--b08e1f3a-6416-4d8c-a7ce-e52f75787938", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caaf1686-7114-4258-a3f8-22eab86ea0df", "sighting_of_ref": "indicator--5aa22dad-dc1b-4101-b673-0093be2282b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9027c273-e47a-41a6-9a84-8d0106b7f2a8", "sighting_of_ref": "indicator--9091101d-c3cd-43ed-93ed-65e2a6688af7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f23fd99c-5c5d-4276-9c35-48a9a0aca4d7", "sighting_of_ref": "indicator--44824c2b-3578-469a-a0a0-911600384d1e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f1dc282-c9bb-4b62-8ccd-96e8bd439a50", "sighting_of_ref": "indicator--d635fa2e-181e-4ad7-8df4-4ce8016d8a72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ac2bdf3-40ab-442b-8435-767927ed228d", "sighting_of_ref": "indicator--eb5bd649-da82-4bb3-85ca-32d06a12eeaa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7afc368-f89b-472e-b682-cb910cad77e2", "sighting_of_ref": "indicator--daec7517-01ec-4da8-99a3-2742a5b8c866", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--579e37d5-5c78-4c89-b353-ab57aff6a49e", "sighting_of_ref": "indicator--dde288f5-d9e9-4957-8afa-5ebe9b5c2c31", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e128a886-c9d5-4482-b0f4-2176779350c9", "sighting_of_ref": "indicator--01eba3ab-2f1c-4764-9bf3-f1bff2fe8264", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98354503-a763-4380-807e-7206af29f230", "sighting_of_ref": "indicator--bec18229-955e-4dba-9d9e-c0eaa68557df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce0ffcdc-940e-4b0d-93ab-3457fdb155dd", "sighting_of_ref": "indicator--e5dc45cf-63a8-447e-abd0-c715b1730a75", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9446c1-7d44-4b78-9125-de8aff37901f", "sighting_of_ref": "indicator--cb8d0a8b-0b4f-4d53-8c84-e42b026abc9f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9067eed-48a1-4ee8-94c9-5accbedf8e21", "sighting_of_ref": "indicator--29e8717f-18eb-40db-beef-f335f117411b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f797283-d05e-4a79-8d35-0a026421884a", "sighting_of_ref": "indicator--d04a0302-9570-4d79-a093-de34ce40a36d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86eda5df-6a7a-4454-9a14-ec7c1f35f182", "sighting_of_ref": "indicator--1d6c47e4-4b0f-4fcf-a76b-4b82d7403cda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00ce1571-3388-4e47-83a9-ee9b2da2859b", "sighting_of_ref": "indicator--ad513f83-8294-4892-ba7f-06f16c190cf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f29ba91e-a9dc-4f92-8b22-5f88afc176c2", "sighting_of_ref": "indicator--9e76c414-000a-40de-a713-5fe284a91c75", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad64b498-3050-4817-996d-4075781720e7", "sighting_of_ref": "indicator--513ace1a-2fb5-43e5-aee1-2f19979379a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2aabb3-b094-4c53-8c97-11fed1dbdd6e", "sighting_of_ref": "indicator--62d75468-92b4-434e-bf7a-3411fdd22037", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc09a12f-e539-4b82-bad2-a0fef5bafe6d", "sighting_of_ref": "indicator--a70a85a8-61c8-4b62-a71a-24a0c842cff9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed88ecde-788f-4c8e-a1cd-9b4b57ab6dec", "sighting_of_ref": "indicator--74e5f7fb-3f20-419d-9698-07983dfac757", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58358a42-6e93-4b2a-bac8-ff434be1639a", "sighting_of_ref": "indicator--31d109e8-68b4-4b24-9a6b-cb7ef4680faa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72182fe0-13ed-4b3f-9752-afd6e27dde62", "sighting_of_ref": "indicator--aa55151a-d9d5-4161-abbb-2f44b8b8535a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991076e5-9de5-4e93-886b-93d7bff80bef", "sighting_of_ref": "indicator--de37135e-459b-4233-b2bd-e5f5f7805439", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2316a223-8227-43b0-a887-5d2bdba819a6", "sighting_of_ref": "indicator--3d3466d1-3d41-4994-8db4-689b69dcd6de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7badb9d4-199d-4357-8d72-e29f4858c289", "sighting_of_ref": "indicator--8367ced1-de3b-43bd-893f-0e720d116bbb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053d4632-dee3-45ee-8fdf-5874d4243189", "sighting_of_ref": "indicator--d200ddba-4b4d-4e8d-99de-b8a866870a4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16ccd84-a8da-4dcd-8fbc-5210511f7c06", "sighting_of_ref": "indicator--acf1afa5-c552-4f3b-b8cb-7ca4c134cf9d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe0c2822-5717-40ec-ac69-bc540dc41306", "sighting_of_ref": "indicator--3c5863ef-5d34-4519-bc8c-2657606ce702", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85579639-c953-4b6d-8679-7d502018a9dd", "sighting_of_ref": "indicator--9ecb1ae6-2e4d-4858-96a7-4dab676cbaa7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec053d6a-135f-474b-999f-4fabbe374a76", "sighting_of_ref": "indicator--1c40141e-bfe1-494d-a069-ba07330c35e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e41d6f-807b-4936-b196-cbc8ce55cb5f", "sighting_of_ref": "indicator--9ccc5714-912d-430c-8d14-3c0f637631cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e947cf-0228-461a-8f1d-7eeb943a0a10", "sighting_of_ref": "indicator--b556350a-674a-4ce9-a3fc-6c24ec41ed93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75978c8-a895-4ed6-954d-888b0134ba70", "sighting_of_ref": "indicator--c2a39539-c1ff-4a86-9315-98eb07592c53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d8b4f3-50d9-4380-8e59-05deec8e3b72", "sighting_of_ref": "indicator--3d152594-5311-40a7-ba58-6ad1cce04e00", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f65bf383-b605-4494-a7aa-3bb4e01e9747", "sighting_of_ref": "indicator--176834d8-f2f1-4f4f-99c1-362e3943355a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4abf847-bf92-4009-88bb-318fff7a20f0", "sighting_of_ref": "indicator--a5da96e3-2df6-4b73-9abc-c187f8457da5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246273a8-c27a-4f13-80db-955dd6163b7b", "sighting_of_ref": "indicator--7870b848-dd77-4e78-8c9b-63af6742a781", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9daf9dca-1c4b-4d35-96bb-2ca7ff3f009d", "sighting_of_ref": "indicator--f580c530-9628-4cc8-949f-998c624f1dcb", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7389ab52-70cf-401d-8885-682975e278a3", "sighting_of_ref": "indicator--9be6e6e0-75d6-4109-b7d5-669907d48b69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f1533a9-c863-4871-b221-9a0c06064970", "sighting_of_ref": "indicator--c36bc389-4704-4e18-a313-e0b519f364c5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d45089b-6eb1-439a-b883-dde01ce41d61", "sighting_of_ref": "indicator--7634fe22-df48-4bee-9a9c-c921282ea60a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7156afac-4291-42e7-9983-f25430964aa5", "sighting_of_ref": "indicator--e87e7bdd-f86b-43f8-9c3d-45764371dbed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72a7f0f-971b-4c15-8c66-259e735515ab", "sighting_of_ref": "indicator--f6e52861-4279-4946-9677-6af847219d08", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4791deca-6c24-4aee-a8d8-a507656648c4", "sighting_of_ref": "indicator--a1adeab5-8acb-4ff2-a877-f795328fa5d1", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5176d9a-7a0f-429c-b05f-3e7890baf24a", "sighting_of_ref": "indicator--d2ba8765-598a-4007-8f5a-3c7a476e762b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199ecdae-694a-419c-819b-abf3594d328d", "sighting_of_ref": "indicator--71e4ecfb-b74d-494d-9c9b-b758bd2e94c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d11c45d-28e9-4b8c-83ec-ed387ddd10e0", "sighting_of_ref": "indicator--dda048b2-fc4b-4c0a-b9a9-e807e6180326", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1532a7c-6cfc-42bb-8bc6-dcda2c155548", "sighting_of_ref": "indicator--f8ec0bfb-688e-4efa-8caf-51fd9b537697", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--857f418c-c79b-471b-88a8-4e54f0bed82b", "sighting_of_ref": "indicator--660eec49-a8e6-42e3-a40c-04ebca045725", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76ca96bd-0c37-4775-86d9-59868de64e5c", "sighting_of_ref": "indicator--373529c4-c9ba-4289-adc1-26d1d9504c58", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40bc9244-1798-447c-871e-b184b974e0f1", "sighting_of_ref": "indicator--338f5603-93e2-4f6e-b3fc-170fecd241e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9bec550-3b81-4bdc-a66c-ecc927229dcf", "sighting_of_ref": "indicator--338f5603-93e2-4f6e-b3fc-170fecd241e1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e51ab3e8-898c-483a-80bc-d995473bb60f", "sighting_of_ref": "indicator--ad70426b-62fe-4aee-b66c-499af347301d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0159d44-bdc5-458f-a571-d29b580dbcfe", "sighting_of_ref": "indicator--d5473b0b-6004-4025-991c-90bc6d838242", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--972e5de5-3d39-4bc2-8b94-01d97f4c6ca5", "sighting_of_ref": "indicator--fbaa963c-5add-4060-a98c-c852ece6bbf1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c3671f9-d82f-469c-94db-c2f612c5e694", "sighting_of_ref": "indicator--64dcb23d-8297-4111-82ec-64f5f880397a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8191fa-8671-4280-bd31-a3c09fc2bfc1", "sighting_of_ref": "indicator--7fc33ba1-7e2d-451b-bc38-16f39deba7d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--652e3ae7-8f03-4a0c-9a2f-6ee5acdfcb2c", "sighting_of_ref": "indicator--e24c4a6c-e877-4499-938c-66c5d7a6ec3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc278a5-99da-46d8-aabf-0363d67c6fbf", "sighting_of_ref": "indicator--cfdd1e7a-0939-4271-afd4-453fc1d90316", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2d21077-78c7-4d91-a251-a58edc3fb08c", "sighting_of_ref": "indicator--1f4dbe5f-18c9-41c2-8af5-3f1a7d8d1d61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71920ac9-9abe-4edf-ac26-5967365ccf1f", "sighting_of_ref": "indicator--da09b1c9-6967-44ba-8c67-819cbf2dc76e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68a47997-f9e9-4776-b975-441db38620ba", "sighting_of_ref": "indicator--2eca0278-2b81-4b0b-810f-e45f78e34a69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1769bfd0-2489-4a48-a3c4-5a08eea1df1a", "sighting_of_ref": "indicator--1f032316-ad53-4498-9677-53d6d1d828dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1c905a-3cfb-481b-9800-07dc68b316a1", "sighting_of_ref": "indicator--5874187e-2b84-42fd-ba1a-0aa447c023cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44ea73f2-4210-41e8-a2f7-39dcab447eba", "sighting_of_ref": "indicator--2bea9c0c-d249-4e35-a0bc-f55bae91d7ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c9074ec-c7d9-40dd-9815-cb66e49fc767", "sighting_of_ref": "indicator--b882309a-ef55-4b7a-a520-b042f867b9e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aec18d9-cb43-4ac2-a691-2a287d6985cc", "sighting_of_ref": "indicator--83430945-1de9-404e-b03f-332e573f1570", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64c8d2fb-a600-4b32-b981-a074033342c1", "sighting_of_ref": "indicator--b6194af5-964c-497a-8bb4-8c024a0cff70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cc03b07-c86a-499a-aa3b-a37c5f5ef4f6", "sighting_of_ref": "indicator--d53d64ba-e88b-4250-b381-4dcef7cd9efa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f940cc25-5de9-4518-90f9-bf6e26376eae", "sighting_of_ref": "indicator--5153f1d4-1a43-4433-8c68-94dbace4bdaf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04c9ca88-b917-4d8a-90bc-05bdea588e7b", "sighting_of_ref": "indicator--f4e023c2-bb86-4c7b-85b3-a2bc8a1f2f6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--914e48ac-f76d-489e-a136-be75de63beeb", "sighting_of_ref": "indicator--a6af4057-1f70-40fc-be50-48e0fe984017", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70e2458a-8b0a-41b1-827d-38df73d9c630", "sighting_of_ref": "indicator--5609571f-b978-40d0-b0c1-1bb834ffd7d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--030995ae-28b0-4c56-b5c7-5c352e6525bb", "sighting_of_ref": "indicator--383445a2-7145-4d4a-bdba-ff2e2755689b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798f8d36-efd7-4fec-9d22-007ff1704f1c", "sighting_of_ref": "indicator--12c73c21-00c8-4d1b-a8eb-75f7690e8ce9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31463a5c-fe9a-479a-87a0-2d6ff3ff3972", "sighting_of_ref": "indicator--56558ddc-e3ef-419c-ac98-adae1ea907ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63715e66-cef6-4787-8f25-353fb00569e0", "sighting_of_ref": "indicator--7ffa3e22-bba6-4379-8702-71fcfa3a6af9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d676c5dc-75ca-4566-a3e7-c7fb9df4092f", "sighting_of_ref": "indicator--aab7927f-4bf9-42a4-b3a8-6a6a0a5fda30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--734c0061-c820-4a80-8a08-e1da6b8f5fd3", "sighting_of_ref": "indicator--0b8abab3-921f-4414-bb1e-e0b8a4b3672d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--950a7f61-0579-44f6-b662-5384218adcef", "sighting_of_ref": "indicator--615bc7d4-1d55-428c-b25d-85d7918edd1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df258a06-8bc8-4ef2-a660-d838d624748c", "sighting_of_ref": "indicator--a3be6868-d692-4a72-a450-926daf4f2ee8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a475ed63-ded4-4a7b-8d3e-500b8a68efc1", "sighting_of_ref": "indicator--dc8f3dd9-cf80-4317-9bc6-b432ad487cba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec64673f-592f-4482-9f73-a44a425382cc", "sighting_of_ref": "indicator--0bba0c73-6b51-4719-af6c-294cbf435f59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27014aa6-34ef-495a-93be-7c83576c12a4", "sighting_of_ref": "indicator--d6c37371-8463-4d0c-b316-46aa20a5c066", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0097ee35-9aac-4f9d-adaa-f9dce0a767fd", "sighting_of_ref": "indicator--a394543b-7e30-4483-8782-da54d429ee91", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22ae347e-72f1-4994-a089-5205e3d449ac", "sighting_of_ref": "indicator--9e80f5a0-6dcb-4a21-83dd-3a7fe7e691d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eed76a0-fb12-47bb-9844-0aa0ad212ec7", "sighting_of_ref": "indicator--b3c928dd-eb47-409e-9262-ec991bfdd3bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b519325-182d-4a41-b4b2-3276102363ad", "sighting_of_ref": "indicator--e5f30110-8e9b-48ad-987f-53b67521b179", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa7150c6-5117-4fe2-b14d-9c9a7552fd81", "sighting_of_ref": "indicator--2897b70f-0666-43a4-82ea-dc772e16ab02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00fc5033-3cdd-45a3-bbc6-4d1dd5b57695", "sighting_of_ref": "indicator--651d4588-3a99-4f1e-9cf6-d88317959599", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a916b9-ab10-46c8-9134-33bbbeec33b0", "sighting_of_ref": "indicator--9d3b9e7b-2e39-4bd3-8447-7a03d472bc29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe5e6acd-bf28-483e-8862-ef84c853ba12", "sighting_of_ref": "indicator--cf8bbd7c-15f1-4bfd-b06f-23af9d4a6f60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8588682-b0e0-4d49-b931-fa9a459fd10d", "sighting_of_ref": "indicator--942770b1-9296-48ca-b7ac-dc8a475e9931", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef4b4f8-8c33-4645-8224-855402c3acd4", "sighting_of_ref": "indicator--bd472ed0-2915-46a1-a99a-17becc168323", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14e9fdd2-cc5c-4eef-8c46-649d670886b6", "sighting_of_ref": "indicator--c50351f7-df3b-4ae5-9992-58a2014f1eda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47491613-bfb0-4579-a752-dc54e6ab8269", "sighting_of_ref": "indicator--1326b90b-e9f4-42e1-ae22-c3bcdfc25b00", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0118b633-f47f-43ed-a425-f85a1f9c1f51", "sighting_of_ref": "indicator--4f009b50-7ead-493b-82d0-85e4ec3796be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1eb6c36-45ee-472f-9d5b-9d541e43c230", "sighting_of_ref": "indicator--013da010-49cc-459d-a74b-32a7c2a42216", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7d8d87-6de9-4b72-97f5-663ede9d0333", "sighting_of_ref": "indicator--9280dfa7-08a6-4d56-b5ab-5d58495dea52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e7c349-ef05-483b-8894-daac0f7b6685", "sighting_of_ref": "indicator--0428a419-e0e5-42b9-9244-31f5435f7212", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b65e15e7-f96d-45c5-8a7a-e7a64e012dd1", "sighting_of_ref": "indicator--7f5fc722-450b-424d-946d-3839db7c5cc8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2610a4ea-1eb6-44fc-acc3-442a0168147e", "sighting_of_ref": "indicator--5a311a48-f62d-47e3-a5a6-5a21c0216841", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--897d3b48-d7dd-4c3b-8f4f-25eacba4bbbc", "sighting_of_ref": "indicator--800f8929-9608-4fb7-a706-eb6402d806ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8765497a-ba2a-411b-bb07-9cb86e5cadcb", "sighting_of_ref": "indicator--ae8482a3-e329-43b8-b83e-921c4e927870", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8619b689-5fde-4d4c-af4a-b51af7769388", "sighting_of_ref": "indicator--ce23cbe1-c660-44bb-9b01-af0ea019c200", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab81023-dd6d-43f6-98d0-3170e3235450", "sighting_of_ref": "indicator--a0b50e26-e756-4228-9b16-75e9b9453852", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--003ba3cd-81d1-4489-9a61-680b624e353d", "sighting_of_ref": "indicator--117560c6-957f-4309-9220-e919002f323a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d75a78a2-4422-4c9a-b4bd-961c49d9c8f7", "sighting_of_ref": "indicator--a6958a55-6feb-42e0-8dce-aba359d29633", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f09df57c-e7cd-4077-8635-c798028dbb6c", "sighting_of_ref": "indicator--a25d67b6-2d7c-4f0b-a7a3-7a04fdb570a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf37ce37-42c3-485d-8e47-4c93ca7f5673", "sighting_of_ref": "indicator--6c8eeba4-06b0-4a5f-bc83-a6e948f28c25", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95d1275e-6a14-4bfb-9b1f-a42fec3634d6", "sighting_of_ref": "indicator--2b57dfd6-2997-4faf-b2bc-d16650e7007b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50c9a2b2-63c5-4e1d-862d-59c88c65d3b1", "sighting_of_ref": "indicator--d719ebd1-26fb-4894-a86f-ec9d2bced6e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58e27b92-e0f4-487d-b81c-08822ccd9a1a", "sighting_of_ref": "indicator--f16b8bc1-7b3a-42ee-bb16-ce18b0f0229d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48b038a-9d2f-4839-849d-808cc8fc7edc", "sighting_of_ref": "indicator--ab48d625-b6c3-44a7-92e1-c0afbf2826e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b36eb25a-34ec-45fc-ac04-0357f85b41fe", "sighting_of_ref": "indicator--087be6f9-0155-4017-a96e-d4b9a11b7f88", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e91d001a-49c2-45cf-ada4-7d9f87c87c84", "sighting_of_ref": "indicator--ad61141f-1599-47a2-973b-551157b2166b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f5f7cec-e0f7-4be8-9090-d1b56ce2ce31", "sighting_of_ref": "indicator--b678a549-cc3b-4704-bccc-3c1fb1eb6f2d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acc12939-0687-438d-be10-b5129010e173", "sighting_of_ref": "indicator--ef134f6a-a238-4431-9525-beedb4fb2c81", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4391803f-d0f1-458b-a8d0-868148f31da7", "sighting_of_ref": "indicator--ad599015-5d3d-4492-a24e-a9ff830213eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb32e53-0641-4d06-9e90-1c789e0bd38a", "sighting_of_ref": "indicator--33c656e5-4cb1-47a9-a930-b9c4efb153d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53ec9e8-50fe-4985-9327-a01b8b4a8fe2", "sighting_of_ref": "indicator--ced461db-1c0e-4fa1-9349-4738d511e1ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d3b3dc6-294a-41f5-bf8d-ca87c40a5ed5", "sighting_of_ref": "indicator--b134dae2-dcf4-48fe-a258-097409983af9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b734049c-63d8-45a4-aa0d-5b705e275f4d", "sighting_of_ref": "indicator--02eaaa9b-ea60-41c6-b294-25fccb25d174", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6032aa9-0f55-4e3c-bbb7-c4f43a78f1f0", "sighting_of_ref": "indicator--281f5ff8-18a2-40a2-972f-c129122e4697", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c32fb6b-f847-4007-ab7d-86b6808b8385", "sighting_of_ref": "indicator--3816a770-359f-4e65-ad1a-30833dd3982e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fe20007-a756-43f3-9d5d-c1320888fb76", "sighting_of_ref": "indicator--53606745-fcb7-4305-9868-8edfea4308b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6660edb-c53c-4fb9-8c05-94ea838ceb4d", "sighting_of_ref": "indicator--d8db713d-cb3f-4c32-bf71-8c61004a2116", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbfdeedf-1fed-42ba-a038-8ee58ea6f9b2", "sighting_of_ref": "indicator--3eeb53a3-aaaf-422b-ad40-3638f18759de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca16cf34-8d5b-408a-b884-a593f841782b", "sighting_of_ref": "indicator--921f5319-115a-4c73-9a3c-e99421e4c8a6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33279ea-0e4d-42a4-b4b2-dd830c419248", "sighting_of_ref": "indicator--9a5e3155-a55e-40b8-bdd3-90a574fe498e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2458df88-5478-4763-89c7-7370729bd524", "sighting_of_ref": "indicator--6024b66f-0900-4b1b-8861-a1f5521d8088", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--271c90c3-4605-45f4-a2af-821b916a32ac", "sighting_of_ref": "indicator--7f3daab8-0138-4b89-909a-ae6c261b0075", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2b1cadd-233a-4567-9403-ca3fbf58affa", "sighting_of_ref": "indicator--0053373e-d798-4cf5-97a5-5bbfd9f2df6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4179b9ee-c7a9-4faf-b0ea-c9fd0f0210bd", "sighting_of_ref": "indicator--a9b54e5e-0715-4b99-99ef-8eba332881d5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3771d819-a0cc-4182-beb8-d8c4c02b6e8e", "sighting_of_ref": "indicator--a75e1224-2634-428a-8fa5-6ca0a44c1ec7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6c46021-e6ee-48d3-960b-dcaeff581176", "sighting_of_ref": "indicator--d814afa0-f773-4ba2-a164-cc211a888ca7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d3d096-f287-4def-b1be-d2035e117acc", "sighting_of_ref": "indicator--c1cd22a9-9498-44bc-965e-fdbb51d05a7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d9c0885-f7db-4c57-b08b-cafd040bf163", "sighting_of_ref": "indicator--eaf56cfa-900e-4dad-862c-92520328379f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b5aef3e-8e2d-49b3-8b50-07563c37ade3", "sighting_of_ref": "indicator--cd7b5bd2-0821-4bc4-ba0b-d649847dcddd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--651fc9e4-057d-435d-b3f4-9c998eefdd28", "sighting_of_ref": "indicator--4100faae-6f9e-4784-b2fd-d7f2118a2e07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e68432f6-ce3d-4c85-afd6-2c0acb1afea5", "sighting_of_ref": "indicator--a48eb42c-250a-4292-b76e-57fd389bcd3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74021f3b-9bac-49d3-9948-f2458712e449", "sighting_of_ref": "indicator--5be533a1-69f7-4348-889b-5072ccc0e0c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40b807f6-3af0-436c-871a-7567a18b1144", "sighting_of_ref": "indicator--157d6423-9bf4-4fc4-9e71-12e5d27082a5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--616c24d7-7f5a-4752-98eb-bc8fbf889784", "sighting_of_ref": "indicator--1aab990c-079b-41d5-b4cf-a48882f2bb6a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b2d1888-0700-4e17-831f-e205eed550a3", "sighting_of_ref": "indicator--dc4028f7-ddb0-4413-ae02-5ad77d25e509", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5a51e0-c4d8-489b-baf9-d89f34bc710e", "sighting_of_ref": "indicator--e39b796d-54f6-4347-b951-9fd6056b24e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1db4be97-3e41-4670-ad77-e869e74ebe14", "sighting_of_ref": "indicator--ab718de9-d9a9-469f-9be5-e53ef36c2654", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db8ced0-e9a5-46a9-9511-03b1dae320dc", "sighting_of_ref": "indicator--01c275d3-377d-4383-ae75-b4925c40f77b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--251781dc-4eb2-4395-91fa-74fe3d680af8", "sighting_of_ref": "indicator--cedea6e6-2251-4a13-9cdb-ff8f9edc871f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1674c62a-9313-4bcf-8133-b6a7853123c0", "sighting_of_ref": "indicator--cedea6e6-2251-4a13-9cdb-ff8f9edc871f", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c07b60-252b-4f14-ad0a-9c362afed406", "sighting_of_ref": "indicator--f2988b06-5936-4ad9-b0b4-aabef7e84d59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cffd8fd-ed6a-422c-bfa9-3b0dadf4b760", "sighting_of_ref": "indicator--7590675e-ddda-4322-b90d-ee466f161414", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a277087-31ba-4af9-8490-580f8bbb2536", "sighting_of_ref": "indicator--deaac993-cc43-48ec-a01c-84816e81217e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84e36894-660c-4a7c-a813-04e662e0cfbb", "sighting_of_ref": "indicator--d13f444f-41b1-42c8-9ee3-65fcc3a50c80", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--611bcc56-8dbf-4ad0-962f-b790b067cd00", "sighting_of_ref": "indicator--6986931d-2bae-4496-b036-423ade09f426", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5fb335d-8738-480d-9129-61cb2134037a", "sighting_of_ref": "indicator--17785292-cb66-4df7-aae0-c836ca39778e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2508ec-f49a-4e35-a11a-4acb58d09230", "sighting_of_ref": "indicator--78249e93-13a0-4c13-8c78-70ee19cca49d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff07172f-e839-4ea7-9379-0daf284a9852", "sighting_of_ref": "indicator--fa767fae-eb92-41b2-a2f3-a0bf41fd5d30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c4a3ead-f382-4e39-9817-5a86fcb5c750", "sighting_of_ref": "indicator--862be180-5672-41eb-9f95-173306a93cbd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d346146b-4a2c-41d4-a766-0a7dcda713ef", "sighting_of_ref": "indicator--d33fb819-0a4c-4536-86d8-13a72703a22d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3346534a-12ec-4a06-a901-1a931ed04a3d", "sighting_of_ref": "indicator--4efca687-609e-4673-8573-4c2fc18152c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5e5e36f-3753-4f0f-9ad2-52cefcf9cb82", "sighting_of_ref": "indicator--d139e204-9f81-4d07-81af-719209f80697", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c32a404e-03a2-445d-9f8f-93764975f837", "sighting_of_ref": "indicator--806c6118-2540-4c4e-88d0-afed691bdc92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3093d86-779d-46cb-958f-f6a3b8d61371", "sighting_of_ref": "indicator--fe0da30b-dd5d-4b3a-a9c8-6828184efb5c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd830dac-2d1a-4c05-9048-c5cb6efcb175", "sighting_of_ref": "indicator--2bbde6ac-e996-41a6-96a3-aa02a6688000", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a10a6b-1bb1-44b4-96f3-a086e447e77c", "sighting_of_ref": "indicator--6ee62dd2-d205-4dc4-80c9-4eebe447532e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d7e1407-adf2-4342-b7d9-0e5934bd42d0", "sighting_of_ref": "indicator--ea381004-dcb2-4060-a6d1-8be46a8bbc0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--def47f23-b14b-42c7-8d42-8a2563eb2c9a", "sighting_of_ref": "indicator--c85f7ec4-2ba7-4e90-89db-9f4492c771d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6abb1f58-afb5-4abc-a233-8cff120728e6", "sighting_of_ref": "indicator--46bcda87-d734-44c2-be7f-9842ca517e99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce200bf4-65df-40dc-a376-41c8aaa8725b", "sighting_of_ref": "indicator--5537787c-75af-4cc9-9990-f673bf6a8bb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b153b8a3-4e2d-4dfe-ac6f-827df9439bd5", "sighting_of_ref": "indicator--5537787c-75af-4cc9-9990-f673bf6a8bb5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0658c904-f227-431a-959d-d60afdebfdc7", "sighting_of_ref": "indicator--61bc3058-e511-4b2e-ba8b-68d2e9f2b67d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0105ca20-27cb-4eb1-8a82-1a68906701f3", "sighting_of_ref": "indicator--0ca4fa6d-e0d8-42f0-8660-558934804cac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2adcb813-7361-4911-b40e-328815bd34cc", "sighting_of_ref": "indicator--0f40d53f-5f0d-4271-9106-24202cd0e4d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aa82134-f0dd-47a2-b0aa-25c42becf8c4", "sighting_of_ref": "indicator--b7c5ccba-8dfa-4565-9107-50da36a35960", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12d2b81f-0945-4b32-bb2f-b0d04230547c", "sighting_of_ref": "indicator--09dbfada-d9e8-4ce5-9469-2844bd82d936", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--918af109-8ea6-497a-81ce-73385173e529", "sighting_of_ref": "indicator--0e399f1a-d421-4ee4-94df-f5d2cfd1ebf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22b9eb63-cd5c-47b3-9e9b-622c7a5a006a", "sighting_of_ref": "indicator--e3539a89-1e6c-4231-b75f-8b260e8b23c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c2670e-deb4-4777-a3e7-e9326c28c09d", "sighting_of_ref": "indicator--4fbb392e-b595-49eb-88eb-054a3ca4a8c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ac7413a-820a-4594-aa18-bb08c292fcf1", "sighting_of_ref": "indicator--c4a2efc4-7453-4052-9072-5ccc1db387d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54935914-3da0-43f8-aa29-386e1e0a4a65", "sighting_of_ref": "indicator--1b2e7040-bd9c-4e2a-8904-759d87ad4362", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d175efc-9b7c-43ac-aaca-736c3722115f", "sighting_of_ref": "indicator--d6648363-247b-43c3-96f6-2f03104d7a49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--991dd878-e171-4d79-9e2b-2deaec824af1", "sighting_of_ref": "indicator--c393dc80-2173-4dc8-b40c-9c6273861dc7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf884993-daa1-418a-b463-9c60b70eb4fb", "sighting_of_ref": "indicator--c133fbdc-8eb2-4618-bba6-b9c7821dbd7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f25ca12-a9f4-4fc0-b997-4ff847326fc3", "sighting_of_ref": "indicator--1c05e254-52eb-4d61-8699-cda8fae101f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50787f66-da4c-43ce-96f1-381c69c49d34", "sighting_of_ref": "indicator--d05ecbe2-01e6-4a70-86d2-5a2948f272b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd3fb17-032e-4ebc-bb9f-e96dfa2b35d0", "sighting_of_ref": "indicator--f85f0c79-2256-43a4-b718-ba46d55ae4a8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad988b1c-6d45-442b-acc9-657e1a01de54", "sighting_of_ref": "indicator--0b26d678-b5ab-41fb-8be5-2f3fba8a95fa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a21f626-29a5-426b-960f-5a8065f6ec55", "sighting_of_ref": "indicator--8f240f0e-af67-4967-bad7-383961841d19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--387ca5c5-ea56-4bc9-90eb-dccea3e5c3e2", "sighting_of_ref": "indicator--320081bf-91c9-4e7e-9a58-16e9ea2225b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f0195b-8a1f-40fb-9286-053bce26bb02", "sighting_of_ref": "indicator--264a5daf-5f5b-43f0-86f7-8cb82efa1cf4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f028d4a2-5d0f-491a-a41a-ff6e13029e7e", "sighting_of_ref": "indicator--a15b9710-1fef-41a5-9a7d-8004ae5241ea", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3efa038-5a80-4989-be04-17256021b05a", "sighting_of_ref": "indicator--9dd9ce41-b831-4bce-b1fe-860aa51cd20b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef63490f-5758-4da8-9209-f51d17728534", "sighting_of_ref": "indicator--44e3d528-7c51-4794-bd0a-73bcbbbe0844", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--218effab-92d5-4230-aa0b-50420c658a23", "sighting_of_ref": "indicator--cce7051e-af1c-45a4-9d98-baa0c38f681a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10f2d8eb-3d03-4070-81da-2f18b8e47047", "sighting_of_ref": "indicator--2ba49248-b1ff-47bf-a8c2-1c2f00cac2ad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9148606a-80f6-465c-a273-e98a8da178ee", "sighting_of_ref": "indicator--0b20f112-caba-4986-bb41-7682c59aadb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c9636c-de67-4613-afd6-32ecb1d007b1", "sighting_of_ref": "indicator--54729277-2bbe-4a06-94ed-7fbfee89cc7d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca3399e4-2ae1-4780-819a-f49e8e164cbb", "sighting_of_ref": "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--609b8242-6466-4eae-88dc-cc013b04f19d", "sighting_of_ref": "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf1afc3-17e1-410f-85b4-aba9967a978a", "sighting_of_ref": "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed44c844-23f8-4872-9489-d661e1665e23", "sighting_of_ref": "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--367aab4a-9785-4550-bc13-8a71634ee4c7", "sighting_of_ref": "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a04a54-95ed-4028-8a42-a5238358ab40", "sighting_of_ref": "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d8d1eab-2dd3-430f-be9f-56de57f97293", "sighting_of_ref": "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b98df380-7a02-4ebb-a2bd-a10bad66a67d", "sighting_of_ref": "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bf72977-c7ff-480c-9aae-7df8d54efb22", "sighting_of_ref": "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c189383-b1dc-422f-81d6-c03a32d83448", "sighting_of_ref": "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeaac1bb-9ec4-4beb-ae93-03d65794eb88", "sighting_of_ref": "indicator--c8de29e6-2658-4336-9e51-266e76c9ec42", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2527fa3e-172b-4714-b234-cd88af2045e4", "sighting_of_ref": "indicator--c8de29e6-2658-4336-9e51-266e76c9ec42", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--083f2713-8e59-475b-98c5-5c418cc57635", "sighting_of_ref": "indicator--c8de29e6-2658-4336-9e51-266e76c9ec42", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f738ea0-45cc-49d9-b8dc-e80ccab28391", "sighting_of_ref": "indicator--c8de29e6-2658-4336-9e51-266e76c9ec42", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72881a1d-b89a-4daa-a845-3451d646bae5", "sighting_of_ref": "indicator--6f7d083e-a72d-4586-814d-5b8374accc2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47939831-773e-4b27-a3ec-5a933b63150b", "sighting_of_ref": "indicator--0c5646a3-e2e2-4b7a-9eef-847c3808c0f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea933c1c-8771-427f-a191-9c4532fb9aa2", "sighting_of_ref": "indicator--3df25f89-4b83-42ba-987b-d688e29f7f90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0432963a-6713-4d8b-b91e-e06d5fbfe8ba", "sighting_of_ref": "indicator--0e2a3127-a274-4b9b-aa74-9cada1282955", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93bcc828-8365-4700-9d13-9858a125f892", "sighting_of_ref": "indicator--2f0f792f-dcc4-40d0-a0fa-b745973073af", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ecf9a1e-de7b-4590-8d50-11afe63277ce", "sighting_of_ref": "indicator--d096aaef-3b76-4ccb-8be7-2b0aa06d2fab", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4244772-0ebf-495d-b6a8-be165c46e94a", "sighting_of_ref": "indicator--c4b77ab5-1dbf-482f-8ad6-03bec9a1e7a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab0f9bf-80fd-4473-bc84-bbaafbb424b7", "sighting_of_ref": "indicator--6f7374fb-374e-4b4b-8787-c59b35e219e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c98923-8d2f-4640-8c43-95c91d745945", "sighting_of_ref": "indicator--0a09a54d-cbab-4712-bb7e-b67f4a0a67bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d9c4915-50fa-41b3-800e-f965f49cad49", "sighting_of_ref": "indicator--49f4ce3c-2d8d-4231-91a3-4d829f8f6054", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49ea7ba4-b752-4c23-a92b-1ff167e80c07", "sighting_of_ref": "indicator--ac85bce3-b11a-4508-a703-6e54a86e469d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c498b9-1a90-46d0-b34f-722cfd72e61d", "sighting_of_ref": "indicator--fabef1a9-75a7-40f4-b1d7-122a57e61bba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--096368c5-c203-4f7c-9fe3-f70ce818fc54", "sighting_of_ref": "indicator--9749eeb6-f779-492b-98a7-9f2a825105f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57d17604-51c4-41ad-8acc-47a90d8c39f8", "sighting_of_ref": "indicator--796a3363-dc94-4bb1-ae6b-0f8b01c68652", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d41e166f-d100-466f-88fe-56ba85508870", "sighting_of_ref": "indicator--eab5d6f2-c6d2-4dd0-ae35-aab4f90e506e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b1305d9-18e0-4a1b-8e9a-c2c0c528466b", "sighting_of_ref": "indicator--32cd1491-d7a1-4660-b425-54fec1007190", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6eaa56f-8577-4e44-84bb-80af644781eb", "sighting_of_ref": "indicator--6def8efa-1a8d-4135-a3a0-a5a4a6d502fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9efb7ef-409f-41a0-ad97-f9d26de99620", "sighting_of_ref": "indicator--ca366b26-9634-49c0-9c2e-c03b311bb6a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef12c1aa-2013-47d3-a2b2-66c901c2e6f5", "sighting_of_ref": "indicator--33fef1ef-d090-4d7b-a5e8-5e8962255efc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fea218b4-e739-4584-8091-ddf1abc3b9fb", "sighting_of_ref": "indicator--36082a88-c0b4-4136-a587-9313e0e95c6b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98851fe-54b9-4ef4-b2b6-a715307a84fb", "sighting_of_ref": "indicator--6ffb4e6c-e352-45ec-be6f-4c75e673dc50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98feaa52-57cd-4473-b629-13064c75effe", "sighting_of_ref": "indicator--b5aa55e9-501d-47af-9fd0-2a91ce1b28f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f075600-7128-45a5-b6a8-aa30b5465c9b", "sighting_of_ref": "indicator--27f6e178-facb-4a59-9e5d-18aba7590035", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd247fd0-e3fd-41eb-ae7b-62ae3dd44714", "sighting_of_ref": "indicator--b8986ab1-e34f-4301-b6b2-2a927d31654f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--342c92ff-ce0f-49d0-8e76-23659badf4d6", "sighting_of_ref": "indicator--d73a8b68-bad0-4e44-af86-782a220570da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d05e929-e877-4247-863f-256607a62d05", "sighting_of_ref": "indicator--0d46a2ec-169a-4162-849a-dc139ca780c3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ba3ce4f-734f-41da-8821-500a68ffb88f", "sighting_of_ref": "indicator--8a8aa87d-28ee-43f7-9534-1db2537a7d6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bde828b-6c0c-47fe-a973-d24835dbb981", "sighting_of_ref": "indicator--7ac03bd7-e8ba-4e36-b280-dad3f4116390", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6702c144-c9df-4bd8-a60b-cc319047ec30", "sighting_of_ref": "indicator--2ed8dcfb-668c-4455-a46d-fe1dc43b5c39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a607b78-4ed5-49f0-b0b2-a62a3134307c", "sighting_of_ref": "indicator--8fc02011-f405-4490-a991-9f98258c1ff3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c27df87-0d4c-4c50-a2fc-5c9fcbf17995", "sighting_of_ref": "indicator--6e1252b8-4bba-4501-97a0-29c4f48f986d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cfbc3ed-28da-48bb-877d-55cf268bf8ff", "sighting_of_ref": "indicator--9645acad-01a3-4a63-9d6e-0b806cc143bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f20aeff-f10c-47b7-944b-06e2ba4e5175", "sighting_of_ref": "indicator--1387004e-2aa4-422f-800c-194d47679227", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c7e80c-f80e-4ee2-bd5f-a8c92ba710ad", "sighting_of_ref": "indicator--a1bb41dd-2c1c-4e26-a0d9-60db4703874d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c656c78-d491-48d1-b260-39ec911ac0f9", "sighting_of_ref": "indicator--a018ba5b-b120-49d1-8605-1842c2edbb27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a34275e-8288-438c-a79c-404f25bb0173", "sighting_of_ref": "indicator--c5d046d3-45cb-47b9-901e-2bc06258e424", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea5bf83-6a6e-4023-a8b5-26f3bfa32e42", "sighting_of_ref": "indicator--d7e6d8d8-1559-4358-a228-78f1b5f012f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e87422-27f3-4260-9c19-7ad3833a7e26", "sighting_of_ref": "indicator--11710bf4-f2bd-40c9-9f71-b3d29220ad85", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a1dfd3-5a2d-4be2-8274-1a60811ed8b1", "sighting_of_ref": "indicator--3f751f17-5b91-480f-9591-17ee5854d7f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda8f5fd-8e6e-47e5-ad7d-d7342ff9d83b", "sighting_of_ref": "indicator--f28d6db3-923a-412f-b27e-766ce0acc3bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ac5bca2-51ef-4dae-a13c-adee5af1c4b1", "sighting_of_ref": "indicator--4e0ee463-b3da-40a6-b49a-f414128955c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4c0887-a2e4-4e4a-b055-d614ab62ee80", "sighting_of_ref": "indicator--267374f8-c508-4b42-8c3b-1677319fac29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719c7d46-85f2-4497-8e26-7c57bde77fd1", "sighting_of_ref": "indicator--15ef1fb5-882e-48a1-ac07-764c6b0ee945", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc67bcab-f79d-4be3-a002-1480dc92888c", "sighting_of_ref": "indicator--ba377cc5-bea9-4eac-a492-68fbab4da1b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb3e017-ff35-43ac-8ab9-1a73c850d658", "sighting_of_ref": "indicator--8f76924f-2d02-407b-9d20-860405a37ba3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40791124-fce1-49d0-9587-5b85e4e9c709", "sighting_of_ref": "indicator--9bc9cfb3-aa11-4541-aa49-3f18f7e9b4d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f83427-102c-45df-9103-7d7e65c9d32d", "sighting_of_ref": "indicator--afa20b65-b43e-4893-8679-88877ae498d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d119e5f0-93f7-4fdf-99be-cd401365f660", "sighting_of_ref": "indicator--6cb6a4a7-0613-4d34-b096-3410a3e91666", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38ff42c1-17bd-4b60-9cd8-440382d8ac99", "sighting_of_ref": "indicator--c6c07f2e-6db8-4238-91de-e3d08ceedf69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07cd9ccd-5810-41b0-9325-d14a95b92d47", "sighting_of_ref": "indicator--5bf0e489-659b-4877-bf38-9b4cf37647c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15890bc6-8ce6-4696-b69c-f69bd91a6377", "sighting_of_ref": "indicator--d9855818-6d1a-48dd-a64a-b354ef699a50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3b928e6-3064-4bfa-9e5c-177f08d94ca8", "sighting_of_ref": "indicator--e1b25d05-d337-4cee-977e-4bb929f8eb2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f533086-c075-45b2-9553-38bf5490356a", "sighting_of_ref": "indicator--1f8f9ab6-b2ad-48af-8f8e-2db5450ba462", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95678784-2e53-4880-8db8-29768ec68102", "sighting_of_ref": "indicator--2157e4b0-4f8a-4477-ab2a-aa36ba1084d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f922104-2c3d-466a-af68-b2b570e12a48", "sighting_of_ref": "indicator--61823c12-b46c-4d9e-b4f5-0a1a2792a595", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d893f2b1-4c3f-46e6-958b-a88a240595d9", "sighting_of_ref": "indicator--8e0be64e-4728-4468-8da9-56fb05b6369e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19826a45-264c-4647-82b9-fe99e3095909", "sighting_of_ref": "indicator--7091928a-6364-4998-ab48-ef16be6c367f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68cc0680-8a6d-4885-965b-c3ef240f770a", "sighting_of_ref": "indicator--4e49b844-36f3-4965-94ea-4a9f344c461a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82137e52-f1d2-439e-b429-da9b87207016", "sighting_of_ref": "indicator--ec184d09-9a91-4cbc-bbc5-da9ecb7b518e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e21f1df5-1eda-43bb-9b33-6f6544835b75", "sighting_of_ref": "indicator--036eaf3a-2e28-4e3c-abf3-8c6f27522410", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4aa57ac-5d3c-41e5-8352-ddca71a9819e", "sighting_of_ref": "indicator--dd9fe8f0-a93b-4e83-a52a-b56f8ccaa91c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b1edf00-6ed9-49f2-a016-50bda55caddc", "sighting_of_ref": "indicator--8992fb9e-1c01-4b00-a030-8ca7f42b2c9a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898747f8-1b26-4e31-ab60-e7b2fb1a3846", "sighting_of_ref": "indicator--9cfc27dc-55e8-4246-9ba5-e6baca93335d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c08c4b9-b977-420c-839b-f0519e76963b", "sighting_of_ref": "indicator--861b0244-64e6-4277-9e11-fbfcd32cf937", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6f56d16-f055-49c9-bd79-175b689b33e6", "sighting_of_ref": "indicator--97156450-1b1f-46b2-9cdc-d1f44bf68fda", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ca1f17d-a4f3-4801-8fae-ebf68c1c6dfd", "sighting_of_ref": "indicator--0145f951-9098-4ee2-b0a3-17b79d79dbee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d121205-0e8c-4f23-9a2c-06d54f7700dc", "sighting_of_ref": "indicator--bf6da018-fc68-4f6a-a56e-f2424a47c8d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aecb6349-6ac9-4060-9525-b4861499d3aa", "sighting_of_ref": "indicator--040bf47c-771e-405e-ad1e-674789f2d39e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d77a38-a2cd-4323-b2fa-dd8abb23d33c", "sighting_of_ref": "indicator--ee336df9-ab8b-4137-8dde-14bdc8e933db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b909b58-ac21-455b-92a1-88c5355fd02e", "sighting_of_ref": "indicator--988dbdeb-3abe-4a71-ac4e-3bb1ae01fdd8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01fb5314-c72b-467a-85cd-6849904a1e83", "sighting_of_ref": "indicator--634910c1-5f98-42c2-b6c2-08f70fd46631", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2b291b-ffc1-4004-9d4d-e5629b38554d", "sighting_of_ref": "indicator--a41fecc1-600b-4a14-90d9-76efc70e1caa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--547c9ace-7114-4e12-b3c8-c2156ab55de9", "sighting_of_ref": "indicator--eb1a1814-9cc4-476c-85c1-634283057e4d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48fd03cc-eb78-4aa3-875e-8bc1aca5e4a5", "sighting_of_ref": "indicator--469b1423-2639-4b2d-a4e9-2be0755e72f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ce59947-3a12-4917-baa7-21258cad7dc1", "sighting_of_ref": "indicator--844b0127-576f-4d90-b90a-4bbc2e0b01ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9750823-f4c1-4e00-93a7-d4b7fd54f444", "sighting_of_ref": "indicator--c1a21648-7f9f-4c36-94a2-4ba6b67f3710", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d07f22b-8756-4421-848b-3767ec8712d0", "sighting_of_ref": "indicator--4b895fdb-ecce-4054-a754-da10187f9680", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--668ce591-449a-4f49-bf38-b3f3bda7f059", "sighting_of_ref": "indicator--69830142-c8bc-4e5c-ae2a-615e31904115", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--383ba1d1-1273-452f-8c09-946d2289595a", "sighting_of_ref": "indicator--094defe1-490e-42ec-82f4-4364ccbcd983", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e62c57d9-b133-4f0c-b4fb-13ecdbfded8a", "sighting_of_ref": "indicator--6956dca6-4748-4fab-9178-a2fb9ff084a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--738ea762-6b24-4b0e-bd84-e689c2a3a214", "sighting_of_ref": "indicator--6e0f0bb9-9a8a-4fbe-85d8-b354a13914a8", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3599eb02-f35f-43f6-bfaf-f0ce84a99998", "sighting_of_ref": "indicator--fdb0e73c-a4bb-4c6e-8346-26aa62127224", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a672e60-15fc-4036-a3fd-17d18a47f811", "sighting_of_ref": "indicator--fdb0e73c-a4bb-4c6e-8346-26aa62127224", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3416e295-5204-49ba-aa48-02d657d78731", "sighting_of_ref": "indicator--e2012481-40e0-4f4e-9843-30c87f1d6d2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcb578f0-9f8f-4265-aeff-e2c806dc8c50", "sighting_of_ref": "indicator--ae2dce03-c8dd-4f25-a3e9-19c4a5793fab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce6b20ed-ebb1-49f3-ab7c-08768fe7dda8", "sighting_of_ref": "indicator--6593803e-9ee3-4e95-80a3-c409f612ed89", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca6c788a-8492-40a3-949d-6bb6fa9b570b", "sighting_of_ref": "indicator--9ede5056-f0ad-45e5-bd6a-e541c36400f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a622fb7e-5519-47e8-aa0d-4893839d8cf7", "sighting_of_ref": "indicator--36fc0efc-c704-4185-b5f4-8f77b856c0e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05523f51-5db5-49ba-93a5-2848be581e30", "sighting_of_ref": "indicator--a4350272-5863-4a1f-8e28-54aa78166cd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c16fea3b-db2f-4a1c-9dfa-ceaebf1476be", "sighting_of_ref": "indicator--76d48bc1-f71c-4a22-95d6-67ff5193fc80", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--747fdd15-e256-4b30-a1bf-dd1ebaf766b6", "sighting_of_ref": "indicator--a89bbecb-76ae-43aa-a0e9-a9d8c00186eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df6ed66a-61d7-426c-b1f6-39c93266801d", "sighting_of_ref": "indicator--0b8f1391-e205-496c-9197-e974cf9923ac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7bbea3c-eea5-40d0-bb37-5d9e336d022b", "sighting_of_ref": "indicator--7a39d5f4-112c-4d70-a472-0c22937fb91f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd94969e-61c3-4e46-b149-e4633ee07d1e", "sighting_of_ref": "indicator--98bbb3f9-5b11-47c5-8296-f2778acc72b3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c90b243-a6c0-47ea-8ec4-496a1401a67c", "sighting_of_ref": "indicator--3d055754-d86a-4eb9-b131-52e16b179e72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e52f0284-b796-48db-bf6d-3eb67de8e4a6", "sighting_of_ref": "indicator--8e6f4495-fee1-4f48-a7ab-fca3f9278bd4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8612f41-23cf-4833-b869-2d8cd5f50126", "sighting_of_ref": "indicator--c962c5f6-bdad-4f8d-8013-6cb3122adf78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ee95bc-5a40-4fc7-a34b-5a0043cbdc5b", "sighting_of_ref": "indicator--311c5f64-dddd-45f4-ae83-83a706cd9e67", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8ffc02-da83-4237-b2bc-2fa64d50c1b1", "sighting_of_ref": "indicator--c36d750b-b383-405f-a158-edb1047db43e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e5e3f9-7075-4c0f-a4c6-1e119f563127", "sighting_of_ref": "indicator--087b810a-e5a3-465a-a404-bc41a617ba02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05d2e1d7-f113-4a2e-aaa4-8a5ac4daea0a", "sighting_of_ref": "indicator--02e4b8eb-8216-4c88-aaba-588158306470", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ad86b6-9aac-4b29-bde4-f9b53aaccdac", "sighting_of_ref": "indicator--da92dbeb-75cd-45ed-8aea-4969af735936", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb25763-93c9-4e4e-8ca8-e951c04e538e", "sighting_of_ref": "indicator--e5b1f1cf-c3f3-4650-8523-dbe29140592f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643120d6-1030-48af-9060-42f4d4a3bc7e", "sighting_of_ref": "indicator--444a4a1c-1d18-42d3-ab0f-1a30b6fc23c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d3cc60-f1d4-4aae-8d66-57f414502861", "sighting_of_ref": "indicator--5a1ca20c-52e9-433c-aef3-0f95d21cfd57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35628cdf-9af1-48e6-a6c8-1cf6a09e6f2b", "sighting_of_ref": "indicator--8c5ac934-c36e-4da0-9882-557c31d54f39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e83b4f4-5dba-4f49-9d4f-cd9a33037bd9", "sighting_of_ref": "indicator--bb757400-d5aa-4be6-ab7c-6ba5151a5bf8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0452b34-4731-490a-ae54-a7efba03a384", "sighting_of_ref": "indicator--321bc0f1-cbba-4bfd-8f88-451f77b4d30c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b94ca703-3c12-4c78-b037-29661259e4d5", "sighting_of_ref": "indicator--e669074c-2012-4b7d-b38c-1e8ab4a691b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51ccfbbd-fe9d-4bf1-af01-fda6b4d2abd3", "sighting_of_ref": "indicator--69eae11c-00b3-4a89-b0a4-e8e8dfe0269b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7abe8717-c0bf-4486-81c4-78024d2a8501", "sighting_of_ref": "indicator--f259ebc8-d33f-4508-9165-3d0506fbe59e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c34a9fce-05ac-4e24-b8cd-c043572a7768", "sighting_of_ref": "indicator--5519fe0c-0e89-41db-ab5d-9b26a2d0904d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1daae36-4386-45bf-aeb6-693acf47a773", "sighting_of_ref": "indicator--b35445a5-4669-4275-804c-45c6d01edb57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--357ffb23-96dd-433b-b35b-f1b1aa29cc12", "sighting_of_ref": "indicator--78cb3d8f-de4b-405d-b87a-6949f97003a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--017d37e3-5b26-404a-a885-8d04de2357e8", "sighting_of_ref": "indicator--b2ae1558-cb02-431d-aa51-679436652c15", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fdc708d-29ab-4dff-8a81-38bb696623cb", "sighting_of_ref": "indicator--0c9bc18b-cb6e-4b6d-81bc-39ebac88ee81", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7d9020e-83f8-4d76-b28f-7de14aafa25c", "sighting_of_ref": "indicator--e8d9b37c-2bb0-4a54-8559-5df055a75df6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fb37266-9458-485f-8325-2d9ad448cb8b", "sighting_of_ref": "indicator--455a1dae-8eb4-4a0a-8d14-cf4c7f5c4049", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55c2e5ed-8d5e-4ed1-af8e-c192a25d27ff", "sighting_of_ref": "indicator--1f15aad3-8d0d-4c24-95f2-61536cb4e776", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7b8cf8f-92bf-493a-bc0c-b17b3ee6aece", "sighting_of_ref": "indicator--214c2951-11f2-43dd-8ea2-6a3b140d6eb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b55aaf6c-ac2f-4d8e-b229-4a89d85737d9", "sighting_of_ref": "indicator--e0191bf3-a0db-4392-b7ab-2c73a98e1405", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a2261b3-c594-4f91-bb85-2e8fec72f91d", "sighting_of_ref": "indicator--c326fe06-8804-4e1b-a8da-e580c6362d28", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2bb40d-ba86-47d6-ad1a-f083144229b0", "sighting_of_ref": "indicator--a4cc7d5c-cec7-45fd-b3ad-fd0f5d58dfbf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7325dc4-bba7-4093-b02e-db102547a339", "sighting_of_ref": "indicator--b12fd95e-63b8-4625-8e40-911239df50d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73899b69-6a17-4048-b868-a7c4729178d9", "sighting_of_ref": "indicator--0c80a813-d821-4713-a293-b30a410f6255", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39071d30-65c2-4a92-b6b5-0d890273619f", "sighting_of_ref": "indicator--0f531399-a3fe-49c7-b53e-698175cb156c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2af1da11-8b77-4098-9dec-75ac718ad582", "sighting_of_ref": "indicator--0d5d5123-51dc-4f33-b0cb-4e4992b0872c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38c57fa1-1961-4c91-a610-99d17558e12c", "sighting_of_ref": "indicator--8105eba7-e74e-4590-a830-aa119979450f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c45f6617-ceb8-456b-a663-0a8fb1bd9c05", "sighting_of_ref": "indicator--0651ed6c-52b5-42a5-9aff-4ff37550d581", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58dc7f1f-c6c6-4eaa-8a6c-d8ed15bb88cf", "sighting_of_ref": "indicator--f0ae748f-441c-4cce-8e51-03c1366b039c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--774be88c-6a43-4537-b8fc-0d59f2f033c0", "sighting_of_ref": "indicator--970f0680-723a-47b8-84e3-dc130eb374d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee9be481-b5ad-4a3b-a7f0-309390860492", "sighting_of_ref": "indicator--d13ea332-477c-4ba0-9a23-b3b15050a50e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1867045-9336-4e2c-a408-856228548bd9", "sighting_of_ref": "indicator--263fd5dc-6974-49e3-b29a-56adb4eaf08f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73add48-78c8-4699-b50d-2caf913cd9f9", "sighting_of_ref": "indicator--a2802751-6026-499a-8371-0472401e8c1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1950a9f9-c0aa-4e21-b41f-937c5cedbe69", "sighting_of_ref": "indicator--68c7f175-910f-4970-b232-4f848f1babe0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61da87e3-5eb1-4634-be5c-77c419955ce6", "sighting_of_ref": "indicator--3b2ece32-47aa-403b-b0f8-be4a59176c4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bde50c05-08ed-4cfa-a840-4195ae3ffd47", "sighting_of_ref": "indicator--74af9a8a-6d50-4e51-8d98-c80e6d0b53d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b79def63-7f7d-42e3-8008-36f89b0f8d06", "sighting_of_ref": "indicator--1dd1f1db-f086-49a9-aa0a-8a4fced75203", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd07a03d-2765-442a-aa3e-a961bf8732b2", "sighting_of_ref": "indicator--36ee49dd-f173-4178-99aa-59590ad71a67", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--724df68b-bec0-43e4-807c-b170d0080694", "sighting_of_ref": "indicator--4ce76033-5d81-4282-89e2-9fde58f28fef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2687831d-71df-4758-9632-5abddb1d53f9", "sighting_of_ref": "indicator--b8bc09c3-113d-440c-abd5-0edea18ccd10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--301033a5-0ef3-4777-a062-e635eef5c183", "sighting_of_ref": "indicator--04ed04f7-ab2d-4611-81aa-1a2dbffe92c0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0097f5bd-3e39-494a-a373-a80722c9443e", "sighting_of_ref": "indicator--d80e827b-cab8-44da-a4d3-a222d2f0d568", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ebcca58-c3b4-4a3b-b596-7dc636e622a0", "sighting_of_ref": "indicator--db64e19c-d6ff-41cd-b5f2-ae88fc982fad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5351f14a-ba26-4bc0-b73f-644889e9fbe8", "sighting_of_ref": "indicator--3053bfe6-efaa-46e2-95f9-e172b09a2275", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c5371fe-9f12-4475-b7e7-030bb4e1ea8b", "sighting_of_ref": "indicator--094d73d3-bcd5-4a6f-a291-3b353492edc3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fe6c75c-a48e-4d28-b80e-f03f561778f2", "sighting_of_ref": "indicator--e983b45d-4417-423e-960e-d92327b9a6ca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34a3256f-4c86-4fb8-b124-d966263c8819", "sighting_of_ref": "indicator--6f91876e-c9b1-4e84-a20e-3b2c65c8e7d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0421871-2051-4ad9-ac79-8df74dcac357", "sighting_of_ref": "indicator--54586b6b-8201-415f-a446-00edcd5aa425", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb5b28eb-9730-4880-8716-9ee2d19dca25", "sighting_of_ref": "indicator--e423ea83-dae2-46bd-9cc3-07aed329b22a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ab0b012-0ae1-46ba-8f23-d0680c441365", "sighting_of_ref": "indicator--192ecb16-c955-455d-ace8-447df5d681d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ff6209f-fc5b-49f0-92ca-a6f992c66980", "sighting_of_ref": "indicator--016bdd7c-5ee9-4b39-a2d4-2211b3138f9f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dfcb517-643e-4153-a604-edcd83c22713", "sighting_of_ref": "indicator--244df7e5-5370-4b62-b5fe-97d443fd0795", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13cd2d79-cbd4-4db4-b135-99eca531abb0", "sighting_of_ref": "indicator--035021bc-b331-4663-887e-fcf681ebf193", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be54371b-99b8-4462-b4ed-f90179b0a159", "sighting_of_ref": "indicator--e5f10871-a6c5-4d46-a627-159cbd88eda8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edeedfd5-f2d1-43cc-872a-6e3ba0ad0bab", "sighting_of_ref": "indicator--2bc0b9e1-bc5b-49cc-b2c9-8b61674c2860", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--495d3099-9096-42ea-bae6-5d060a475644", "sighting_of_ref": "indicator--8ec9e987-7036-43b0-ae07-1142ca05b5cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27b90a52-cca9-4caa-9ad4-8ede43327455", "sighting_of_ref": "indicator--1c2e3a77-2178-4cf5-98ba-31c07dbab7e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f5ce7fa-89e4-4ace-acb2-a5c5eedf8576", "sighting_of_ref": "indicator--68e845cb-edf7-4025-a111-36ba902e2d36", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987805c5-297a-4cd2-8aab-602d4c828360", "sighting_of_ref": "indicator--96c3588f-9b81-415a-9a34-7dc04bf7adcc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fbf2c58-b614-49f3-a484-f394e2103b1e", "sighting_of_ref": "indicator--70612d66-7f47-414a-aba8-3a0b8c0fa26c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03162db0-03ca-4168-a8d9-688c1e9a52fc", "sighting_of_ref": "indicator--fd0470d5-7308-44a2-8d10-8eff10a0afd5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a692edf-1a27-4a38-91c6-f58ba00eac39", "sighting_of_ref": "indicator--bff45381-fed1-47e2-8e3a-e797bc8ac305", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59706a1-6fc9-4ff6-8897-fb5f31d881f4", "sighting_of_ref": "indicator--5520fec6-4782-4388-be42-cd6891d2ebc3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b78c7698-bbe2-4bf2-b7f1-1b0d509299b7", "sighting_of_ref": "indicator--df4ee3cd-4c2f-4ad8-9960-f06a2779af07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2d1c83-c071-4666-a91e-b10e25f119f2", "sighting_of_ref": "indicator--086eb3eb-55ad-457b-b8fb-7d5936d7e649", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcbf090c-7a82-4e22-916f-b0d8959866bd", "sighting_of_ref": "indicator--071c91e5-9643-4f71-b8fe-5b3e0f81ee97", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30f3f1e7-e869-4860-9be5-efe73ea2858f", "sighting_of_ref": "indicator--a0c4aaa9-25e9-4798-bbf4-5d5a05e2cbcb", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38192d57-2a86-479a-a327-cba31cd9943c", "sighting_of_ref": "indicator--570655d8-d296-4d86-8177-70024fcfe3ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d1eeace-2edb-40b5-8b96-8546a46e9f55", "sighting_of_ref": "indicator--d332633d-b71a-4078-97fb-1d15ceb170e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bbf3627-a480-4439-b17d-911daf020c3a", "sighting_of_ref": "indicator--c8add0d5-7993-41ad-91a8-1e7b3dae3ae2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c03efba9-e0b5-468c-93b7-99dc5311e834", "sighting_of_ref": "indicator--111088da-8f0f-409f-a3fc-36520b4865bf", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6393fe4f-647a-4599-8d7c-e0cde1cafca7", "sighting_of_ref": "indicator--0e852f8b-67d8-4e82-8e38-b93b882686f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd12e1e3-d5f6-41c9-9f6b-771cb4eb6ae5", "sighting_of_ref": "indicator--c0cd467d-0bef-4e22-84bf-7b4dbbc5c70c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4c4eb4-344a-412a-9ba1-c9af971bdc4f", "sighting_of_ref": "indicator--085a7b3f-fedb-4c79-b631-8f0e853f805c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0352a01-919a-4e7d-ab8f-0ccf077ff016", "sighting_of_ref": "indicator--e6ded4b2-41bb-43cb-a081-59041de49199", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c370f16-6b77-4332-8ac1-0790831de1b9", "sighting_of_ref": "indicator--8f10a298-33af-4da6-85ff-b8279b6bd1a4", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943f9775-9ae0-42a8-b802-63fa4c317440", "sighting_of_ref": "indicator--d725eef3-e21b-406b-8406-2c17d193eeba", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e49d97d-cd01-4bf1-b534-ac93043ff587", "sighting_of_ref": "indicator--ae61cb7a-9eb6-41f0-81ff-f6d847b1e9ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d7ee1ac-703b-4b45-8ee6-0ebd2cfb6a91", "sighting_of_ref": "indicator--e1a26e80-9980-431d-8671-77715243b755", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6ea9981-5a25-474f-b645-735786ecf951", "sighting_of_ref": "indicator--ea0db830-0924-4a2e-a1c3-72c09ba73164", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60389d46-9061-4ca6-a588-7ebfef95b32f", "sighting_of_ref": "indicator--ea0db830-0924-4a2e-a1c3-72c09ba73164", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eeb0d7d-66e3-41bf-9b28-331813d42874", "sighting_of_ref": "indicator--33068c75-3859-4cc0-85bf-dc1221543871", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bca23b9-0490-4c9c-bb1c-d7dcc9d634ed", "sighting_of_ref": "indicator--ecf19795-c3c7-4a35-b893-c0ccbe3d6296", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--342511cd-4eb9-468a-bdf6-05e5256db51b", "sighting_of_ref": "indicator--92c5b192-185d-4e15-9440-b8b20cf4d201", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cca0790-6bb5-41bd-81ad-d932ea698aea", "sighting_of_ref": "indicator--ebc0e83e-821a-47c6-8ad5-8b7096676fc8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0a58aae-a9cc-460b-9426-0c295b0e5bcf", "sighting_of_ref": "indicator--a0d3b9c9-702a-4674-9220-c1df57a4eeb8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4cb3d8e-8517-4496-9f8f-e2cb62572a42", "sighting_of_ref": "indicator--d6a3070c-a338-41fa-a167-9e06bb88ed01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06caa408-37d6-4492-b604-ea33329776d1", "sighting_of_ref": "indicator--afcd79a6-18a9-440b-86d3-ddf2d7e40f7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69044cdc-41df-41ea-9935-529c40bb253a", "sighting_of_ref": "indicator--93d729ee-7ee7-4a2f-a993-fb939a1187b3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc74d4b-bb2f-483f-970e-ace09c75429a", "sighting_of_ref": "indicator--624b5b93-b0a6-4a5b-ad72-9505047e6427", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bffc916f-a520-416a-9eda-c80b77242704", "sighting_of_ref": "indicator--db42b23b-3cc7-48a2-b8d4-1f2d8c806661", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--378bd278-afcb-4f1f-92b9-b18116854e6c", "sighting_of_ref": "indicator--331b0dad-bbcb-469d-8348-011ffdb864f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4983b602-23d5-4392-8c44-468e7331489d", "sighting_of_ref": "indicator--0c6045ad-6767-4880-bc41-d018b68bda07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--214855bb-692a-4629-8a10-4acdddfc4bd2", "sighting_of_ref": "indicator--f81b31c8-24fd-48e0-b44a-7799d9cd481f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5f0938a-6f78-4d50-8835-659bf85fac93", "sighting_of_ref": "indicator--ec795f5f-fdf2-494a-8f8d-2bc15f9d48f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e759e132-1d65-43dc-ad89-cc8d7eab6c27", "sighting_of_ref": "indicator--7323a5ed-7b2f-4246-80b9-82b54671e1ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--789df7fa-c7e4-4640-87cf-c5c221ed70e8", "sighting_of_ref": "indicator--bd503649-65ed-4562-a549-bde19460658a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92ce6d7a-392c-4738-8cef-204b6d12fe43", "sighting_of_ref": "indicator--826b0d6a-8258-402b-b306-89b00c2fabac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f9c7ce-efcd-4d32-8305-42754f4889a3", "sighting_of_ref": "indicator--5c0719e4-1373-4f40-9fea-b04a50b5b63c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c9c705f-d081-4177-8ba3-569e85a11108", "sighting_of_ref": "indicator--958f5b60-f1e9-4e47-8359-a3381e31c352", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4999b238-201f-4360-abfe-9960669b1cbd", "sighting_of_ref": "indicator--920bb717-e2ba-4273-996c-6cfa3ff602ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab5f5b4-2dcb-4239-8451-2c1bbae87861", "sighting_of_ref": "indicator--51f7cf21-302a-446c-89c2-e99ed408906c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01bf463e-1a55-4e77-b88b-587bb584d00f", "sighting_of_ref": "indicator--59ba2549-bf51-442a-98b2-20bde672f87a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4673ca0-42e6-40fb-8eea-7e4d97213387", "sighting_of_ref": "indicator--80e6ab7f-7383-4ac4-a689-95d46ed04b07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--177d0165-4d5d-4324-aab0-2691ec1d5ff1", "sighting_of_ref": "indicator--56540852-41e1-4cb0-8fc6-d3202192d253", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c389622-b51d-41e0-adf9-277ef9cd9050", "sighting_of_ref": "indicator--5de969f7-9e92-4b3d-a98d-75988f3b7a2c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7756d37-12d8-41fa-b67e-7433ac3262fa", "sighting_of_ref": "indicator--4863e35c-5f14-4d67-9d59-db998db56a62", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--038cb43e-88da-47d1-9ee2-d8981b65593b", "sighting_of_ref": "indicator--432df78f-935d-4b67-af9c-cfe647c7ad56", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd829d5c-c551-4c31-a800-8204d07b24cc", "sighting_of_ref": "indicator--432df78f-935d-4b67-af9c-cfe647c7ad56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3db8c73-f979-4ec2-af94-504eaf3d9c8b", "sighting_of_ref": "indicator--4ff29ab6-bb3e-437c-b3aa-1de57b7a3ef8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad1f385-dce0-4c63-8fd8-cefdaf06cb5b", "sighting_of_ref": "indicator--95440367-9650-4750-b9ba-4693e97003f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d1e0416-d5c2-4089-a9bf-f91ebe78bab9", "sighting_of_ref": "indicator--fb79df2a-b915-4b4a-b407-7c18b5092caf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a71b4d9-3b7f-4478-82a2-1b3411520256", "sighting_of_ref": "indicator--206ca867-84f1-4807-a414-1156f9a9b064", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5986a76-cabd-4d94-939c-0a172c912264", "sighting_of_ref": "indicator--39fe7aee-e9f7-486b-892c-a4f89c8850af", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a3dd50b-4d98-40e9-8e73-0890966bf725", "sighting_of_ref": "indicator--eab95f37-08ae-41aa-b269-0158718aabfc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a8a15e-6a5b-42fe-a0a5-60f103e32397", "sighting_of_ref": "indicator--3801d9e5-26e3-4456-bcb3-38d08a9ba0a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a0bd42-2c75-421b-b812-612406a00477", "sighting_of_ref": "indicator--288067aa-16f5-4b82-8f36-55571b539474", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98578c8a-1520-4a1b-b2db-da81fc261a94", "sighting_of_ref": "indicator--da91afdc-acaf-4764-8c4a-59eeab3fe39f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--481b1d40-93e5-4d42-9bfe-872d6f4adc68", "sighting_of_ref": "indicator--da91afdc-acaf-4764-8c4a-59eeab3fe39f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fda7433-6164-4afe-9587-a8d62d3f0b6c", "sighting_of_ref": "indicator--598c9674-b35c-476c-ac5d-d4f29da23e61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c24ae8f7-f648-4169-8ab1-5aef2cfbc1aa", "sighting_of_ref": "indicator--c08d6faa-279a-4f52-b2a2-8afe220c7ee9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f87366a2-df74-4d68-81de-ac8739d3f29a", "sighting_of_ref": "indicator--43818b21-861f-4eb3-b6e3-7237568fdf29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76bdceb4-6a23-4cba-ac7a-8d83d60a22dd", "sighting_of_ref": "indicator--b63b27bb-8611-484c-bc85-60153c55dfcd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829bfb5c-c9f8-46d0-b98c-dd3b4536cab1", "sighting_of_ref": "indicator--789d9907-7ee4-4f98-9006-01308ed0a410", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd74c51-d469-463b-8d4b-5699af30895e", "sighting_of_ref": "indicator--4fad2111-000d-4f8f-878f-a09881a957ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--817555a7-09ec-4098-82de-abdab8721fb9", "sighting_of_ref": "indicator--2b0c7a8c-d26d-4dea-93f4-231ffd2d223c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e2d447-8d2f-458d-a264-092eb8fb7548", "sighting_of_ref": "indicator--53275931-8220-4071-9fc6-a3a50d77b85e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e37dc5d-fa8b-4985-a730-df673144831b", "sighting_of_ref": "indicator--d3dd64cd-6eb5-417b-8a86-d6f60ff4d659", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c7061f3-bd4f-482f-af82-f62f147058f5", "sighting_of_ref": "indicator--d27820cb-106d-43cd-bdae-1cfc869aa213", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1f18f3-1e5d-4298-8e2d-dbd2db3f2a3b", "sighting_of_ref": "indicator--3114b1f9-7a8e-453f-8a16-42ad73fb4436", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34c7ba43-d55d-42d9-b762-adcad1269269", "sighting_of_ref": "indicator--82f0a36c-bbfa-4448-b2d2-b315085d5e1d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b92e8bc-f5c6-492c-9c73-f191932bd923", "sighting_of_ref": "indicator--bc2b2313-d208-426c-af08-062bd7bafdae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62d7d828-f1c2-4bb1-b0dc-15f98b3be422", "sighting_of_ref": "indicator--1b7df2a8-bc74-491b-92f9-1ccb32944b76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--729aba79-c2b0-4bc3-845c-1161e4f10b06", "sighting_of_ref": "indicator--18afe35d-d145-4278-9cca-a107da279abc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6605f0d-0e01-44a2-a932-0457f5d8fb19", "sighting_of_ref": "indicator--1d0559b6-28ce-4a04-8669-a15ea03b5f7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f210063-ce5e-42b0-9e6d-b059459be3c2", "sighting_of_ref": "indicator--cd612861-e6bc-4719-83c3-53f94306d3e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1aae4ad-1592-4b69-bcf5-2998a762620e", "sighting_of_ref": "indicator--cf1b8bac-4417-4c2f-a5c9-5e8e0a941467", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5cd913-ea72-4b59-a6a2-cc148cea9a1f", "sighting_of_ref": "indicator--cf1b8bac-4417-4c2f-a5c9-5e8e0a941467", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfffa114-4a67-462b-975b-1b19e55a9c31", "sighting_of_ref": "indicator--b5bb01d5-3608-4e05-aaf4-304cf4f65fc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555ba487-3305-4a6b-9507-f0a7d7a55dee", "sighting_of_ref": "indicator--a4e08818-7d7d-42e6-beba-1afc2fbf515c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea3a0d72-f763-4bed-bbdf-b12372912520", "sighting_of_ref": "indicator--68275d33-6cd3-4689-8118-730951443268", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a4fd784-a734-4dc9-8ea1-d591ef8a22cf", "sighting_of_ref": "indicator--1008257f-6cdb-4a68-9a48-52919b5abf71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a61576-7dec-4cd0-841a-1f76a3367a5d", "sighting_of_ref": "indicator--66f6d23c-0c4d-4691-8e82-6bc7d7ad8684", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eef517c-d8fa-4a06-be7d-c5ba1173c68d", "sighting_of_ref": "indicator--8c1564f5-711d-48b3-8283-85883afd0d59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465781b6-2030-4e86-ae8b-c9a496150d4b", "sighting_of_ref": "indicator--e607804e-426d-4a29-84f2-b645a4c59a98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b714410-3036-43f5-9269-36ad7dbb1afd", "sighting_of_ref": "indicator--81c7468b-ce6f-4546-bb95-0e71f9342b89", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53fe2fa-604e-4d26-9b91-27a89e1fd4e2", "sighting_of_ref": "indicator--e9e7f220-bf35-4e2c-9ea4-abfd4da25a13", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad4e8965-9523-4ef9-888f-58fcc284ffe4", "sighting_of_ref": "indicator--a7fc2b54-5840-48b5-93c5-4e50a1190be2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d79bc9f-35b7-4d91-816e-29b10f7c4fce", "sighting_of_ref": "indicator--f94d5120-ba7a-4e7b-9f99-c9c41023289b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e5e2fa-2810-4202-bc29-df22acf0df07", "sighting_of_ref": "indicator--a7567245-005a-40ae-b0a7-217e03dfd6c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ee64ab2-0e53-4918-92e4-1f1deb168021", "sighting_of_ref": "indicator--05464b7e-63eb-45d7-8b3c-e71d79855b55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa6004d6-43bf-4769-985a-7d3b31879139", "sighting_of_ref": "indicator--b899f4dd-05cc-4702-b032-f66853373724", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b81afd60-1bd3-45f9-9ef0-047af37b6414", "sighting_of_ref": "indicator--d41dc0d4-eb68-4131-983c-19efa5517dd7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1ce9fc1-9f78-4748-b55a-b3b208bfd7aa", "sighting_of_ref": "indicator--1ab1a9b1-c0b3-42e3-b314-7bb25198d9cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d2f35a-f8d8-40a9-b218-3ee0268ee458", "sighting_of_ref": "indicator--152285b4-7c1a-4e9c-a018-f3f1150b7338", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc001ec7-fee9-469b-846e-ab0dac801156", "sighting_of_ref": "indicator--3f1d7170-595b-4621-9487-8c732f081b41", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19c9f4c8-3822-47ea-8e12-645d01d7f77c", "sighting_of_ref": "indicator--952b1405-9c13-474f-a432-57394b28a550", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf0916ee-51c9-4ce2-9441-89fcac0c043c", "sighting_of_ref": "indicator--bc8878ff-4e53-4bcd-8cc3-b7852d434923", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--759ccd97-ffed-4456-ab1d-e49b0516c514", "sighting_of_ref": "indicator--4ddf2d87-fe3f-46d5-a40b-eee183a2bae1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e045a82e-8db3-4f9b-b263-2fe79964a7eb", "sighting_of_ref": "indicator--4ddf2d87-fe3f-46d5-a40b-eee183a2bae1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52549833-11dc-4d06-bf07-1804845d3595", "sighting_of_ref": "indicator--a4113307-9781-49b5-8c85-17cb0d60cc90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35719327-0d97-4408-874f-9385570fdc09", "sighting_of_ref": "indicator--66288729-b828-460b-af31-dc41e0c103db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6e9f46-e50d-4ec6-936f-ce536af9e100", "sighting_of_ref": "indicator--aac3dcac-5f50-4c14-8e6a-49e122846199", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b5016b1-ac0c-47a0-93c6-50e5882cb8b3", "sighting_of_ref": "indicator--12731586-af65-4e77-a0bb-26f355badb6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91e9dce0-e8dd-45c3-85ef-70ed859c1436", "sighting_of_ref": "indicator--0c3cb718-b8dd-44b8-a03d-1ed2a0c9055d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f05127c6-7903-4018-b373-daaa4e35bd60", "sighting_of_ref": "indicator--cf96c593-9dae-42ad-a266-088ca695559d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9537edf2-158b-41d4-8048-f28801636b1c", "sighting_of_ref": "indicator--6f753301-15f1-401b-8b93-112a600ad82d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a6c524-637e-4738-83a3-8ae81039dba2", "sighting_of_ref": "indicator--6f753301-15f1-401b-8b93-112a600ad82d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52e65222-fbef-4075-8c94-854da39c6ce3", "sighting_of_ref": "indicator--87815db5-f70d-4efa-9662-f0f0cba25952", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ce21da-bbcb-4b53-940b-a985f575b79f", "sighting_of_ref": "indicator--23b7e811-b0f7-44c9-ab37-a1c7e67dc4d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fd37854-223c-461d-a1df-a6ec4c337a2d", "sighting_of_ref": "indicator--72a9b97a-5f6f-4154-aa78-5286d342b721", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5c3cacb-5c2f-4a10-802a-9b32a479b664", "sighting_of_ref": "indicator--c318068d-eb0f-4b96-8f91-7645f4f56f8d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f9310d-3298-4a2f-845d-1543131513b3", "sighting_of_ref": "indicator--d4a8780e-1ec4-4303-a8f6-2aad396b6ad5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c01323a7-7d89-4d47-b788-f5c11cca8ea8", "sighting_of_ref": "indicator--540cd9e9-1fa9-4881-947e-5b8aa137a4d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ee8e09f-70db-49a2-a20b-72b8655e8aea", "sighting_of_ref": "indicator--aafa8857-8d53-4b30-b484-c23d2d380d5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72e2cb37-ddb4-4d82-9b0a-3481648a394b", "sighting_of_ref": "indicator--6b056023-7ff4-4d1a-9b95-4bd16b141878", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34241214-f647-4340-9fbb-e2ff39e58a37", "sighting_of_ref": "indicator--c6eab4cc-9017-4cf2-84ed-9dff6d5c7a1d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2acea9d-3531-4c14-aa58-62d9335be727", "sighting_of_ref": "indicator--f64f7270-9ea6-42b3-9782-020fe9b5a3d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a87d7f81-f331-463b-9e0e-d0a8d558fe77", "sighting_of_ref": "indicator--7014cfbc-28fb-4c41-9607-1fe3214c07be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f861c8-40b2-41c2-a1c6-160894ad1683", "sighting_of_ref": "indicator--63f55700-cc5d-4046-90e8-e574d5349cdd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943df859-8cad-4fa3-9f85-2d9406b553b3", "sighting_of_ref": "indicator--292e1fce-c271-49b3-a4f0-8da8846b0865", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7467c88-ead4-4587-abe3-d4aa99aaa9df", "sighting_of_ref": "indicator--b90a0528-e5bb-47b5-8f86-33896e7aefd6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--030a1b72-f616-4033-9243-d42babb5b8d2", "sighting_of_ref": "indicator--dd34d941-6777-43ce-b153-ae0ef5f71f4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a34e8a6c-b04b-4e52-a55c-c135345cdc0c", "sighting_of_ref": "indicator--1b23ec19-533c-4439-a1bd-ac7b92898c3d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38aeccd-e422-4065-b114-bfe61987d83e", "sighting_of_ref": "indicator--d16457e5-f212-4351-8b1b-c3e149c1f54f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f047d30a-adf2-4018-b97d-900d91e07c2c", "sighting_of_ref": "indicator--ed2d2539-bdca-4992-99f7-cea636b94b66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e043249c-dd52-4feb-950b-931e8b2bc239", "sighting_of_ref": "indicator--ab14f97d-d6ef-4eca-92bd-f12f26e0c371", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f0129a5-47d6-4925-bf74-b3bd908c13ef", "sighting_of_ref": "indicator--7dd08493-95d9-4404-b139-1ffaf26450f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdb10754-d814-4995-b4dc-dc60e35ad814", "sighting_of_ref": "indicator--2b8eafe6-29df-476a-9e31-8973fd494879", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5dd45ba-067e-4193-9e68-81db360bdd40", "sighting_of_ref": "indicator--5479fb4e-1dde-41eb-9048-ec747839fca5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--401ebd04-3a39-4d15-979a-787a70ed7a29", "sighting_of_ref": "indicator--157bb697-bc2c-4cb8-ac23-1a9633e22ccd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c94dc7-5432-45a0-84f9-e90241475da0", "sighting_of_ref": "indicator--9e09b4c2-7c27-4db3-bfff-6962642c14b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b8e386e-d376-4dd5-bc88-977a1c1de56f", "sighting_of_ref": "indicator--7007b5f4-4347-45e3-a346-78c8f2339f76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b10524-df6a-4761-b34e-6c52b7822abc", "sighting_of_ref": "indicator--8c913ba6-58f8-4a33-9548-ef3da7294378", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b8a2a07-9994-4978-834d-31dcb93b0c3d", "sighting_of_ref": "indicator--ca39746e-c016-41a0-a2e2-e8b429e76ef1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e312d287-de9c-492b-967d-10606ada5345", "sighting_of_ref": "indicator--db908d33-2c63-454e-bb2f-bf5c49b3e7db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68f0221-163d-4637-95be-1b37946ff77d", "sighting_of_ref": "indicator--6e761f31-6077-4d25-826e-e238df000d79", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6362b024-a777-4144-8b9e-50054cb11d44", "sighting_of_ref": "indicator--4b153558-04fd-44ad-9b75-0e883e5afe20", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fe106f8-414d-4e6f-a014-af578d816bab", "sighting_of_ref": "indicator--cc1a9b71-b208-4e29-8f78-303a108fbc5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6acb72-c6b2-4e0b-827c-96c4c0df17c6", "sighting_of_ref": "indicator--9897a496-2700-425a-91c9-fba89aaca978", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fe8afb0-a5ac-4b2f-af84-ccca53f56e0c", "sighting_of_ref": "indicator--d1166760-115e-43b8-b14d-eda01c167ce2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2879c66e-7ade-4235-bfef-2a3d14dcf5b7", "sighting_of_ref": "indicator--761f82f5-c9d7-4860-915e-b1233b36ff09", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e6c1e47-c848-4e06-aaa9-1621b6b7e109", "sighting_of_ref": "indicator--e6b0b5b4-e2b6-4dc6-bef7-133c30ac1111", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bff1485-eb44-4707-af7a-a81a1783142a", "sighting_of_ref": "indicator--086fce74-fb84-4259-aa5c-99880b2797a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0137daf0-1b91-4b2e-8e69-3761e2c82b56", "sighting_of_ref": "indicator--ac20d51e-9b00-4684-97bd-3ffc9397f58e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0371bfc-282f-4754-a1fa-acb4e636853a", "sighting_of_ref": "indicator--6de06b78-6bdb-4d7d-91a9-596afd200ff1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--094d0420-f9aa-4ded-860a-4f3e6d0f56e8", "sighting_of_ref": "indicator--f3f5b7d0-a1d1-4541-ad4e-e5dfa6a851d2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f75c29b-788d-4228-9c99-8d57d1abea80", "sighting_of_ref": "indicator--7d37defb-0600-4650-82e7-40cd919f7ee4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ada7bd62-1fb9-4e92-8766-4ad915519800", "sighting_of_ref": "indicator--97e9b09b-bb50-453a-b721-e5582b730c39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cf3078a-8096-43bb-bc51-4fbda63c99d2", "sighting_of_ref": "indicator--92ef6387-9cff-4fb0-b083-8b792b443805", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a7a9af-8327-4958-ac07-c8fc125be9fa", "sighting_of_ref": "indicator--2e0cc8f7-6a18-47ba-b3ff-6c74b4f3b254", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b39b409-6ffa-4396-bce1-c322dab5166e", "sighting_of_ref": "indicator--c02f3cbd-3b69-4be9-a60b-d1717bab83df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--725290e2-ea4c-4c2a-959a-bc92cb6947ff", "sighting_of_ref": "indicator--ba6eac84-c4c4-4d0c-b181-d0ccb8954b6a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a246ee9-7726-4600-bb6f-ac855184dcbd", "sighting_of_ref": "indicator--343ffc03-54fa-4b55-a0ad-bc50cadb18e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41e0467b-fa19-4c5b-a831-cf45f6fe236a", "sighting_of_ref": "indicator--40077c44-e5f2-41e7-a5de-7eb223f27554", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051546c7-b26e-4c92-9c4f-ebc6f8cc4687", "sighting_of_ref": "indicator--8b68ee71-e9b1-4241-bef9-32a53b4eccd5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--804cf50b-3f16-48b4-ba59-da0fede9b160", "sighting_of_ref": "indicator--25196627-37e5-4efe-993b-78bb1e26d1d4", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3f8c254-2f8d-47f3-88bc-e3962cd5cfff", "sighting_of_ref": "indicator--71881f2a-289f-4fee-b092-8f771901b971", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d00bf0-f272-4891-b57e-778f7a2c303d", "sighting_of_ref": "indicator--0b2d02d7-256f-491b-927f-889e454abb09", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935a2f58-fce2-46aa-af43-0b1a1043ed0e", "sighting_of_ref": "indicator--a4ad87c4-2939-4503-930f-6c36ac54dc82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--170d497a-1d13-4ce8-9788-a9a635a80b75", "sighting_of_ref": "indicator--613e196f-2f0e-4fae-8981-e23dbfbd8a9a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53e59de3-ae2c-498c-a757-f3dabd708a6b", "sighting_of_ref": "indicator--471ea9f6-d83d-42c9-a2f2-05d2db9276d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0f701e5-50b2-4264-9912-ec37c4367ebe", "sighting_of_ref": "indicator--69a0da0a-6841-4ecb-bda9-b9b826ab7660", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0701894b-573e-420c-b395-331e65b53eba", "sighting_of_ref": "indicator--69a0da0a-6841-4ecb-bda9-b9b826ab7660", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--195334bf-c05a-469c-aaca-e5b436a6b4ef", "sighting_of_ref": "indicator--219b2463-8c2e-46a8-9f3e-842425255747", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053ecf77-a615-441e-b794-6c7ca92d777c", "sighting_of_ref": "indicator--394f0820-01d5-4cc5-9d25-1916cff56fbc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c3f517-8ad0-4b14-bf01-ea2ab16d1d7f", "sighting_of_ref": "indicator--8c0d5a6d-65b2-4ff9-9d22-438d00650ba4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66038552-3a7f-48b2-9bd3-6ca2c7b77fac", "sighting_of_ref": "indicator--38e62702-cc06-4c53-9d2f-2b6c736e64ca", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49cf385d-3909-4208-86f5-ce6d1b0c7a06", "sighting_of_ref": "indicator--80ca88be-6993-4583-a7b7-81721e6025cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ceec84-9782-4355-a9a4-3feb638fb82f", "sighting_of_ref": "indicator--e7343fff-709a-4f55-9124-1e3b888fb0df", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76f8797-570a-42cc-82c5-b73bc2f96d6e", "sighting_of_ref": "indicator--1957fb84-0df8-4930-958a-45165712fa1a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b281e0ab-ce67-437b-b93f-be681b386188", "sighting_of_ref": "indicator--d287d48e-445a-43df-9ac2-de8caff72bfe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bcd1f2d-4515-494c-a16a-aeb82998f2f8", "sighting_of_ref": "indicator--173823c4-7ab1-4ba7-992c-6780a448a4d5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0191afe9-fd95-49c4-aa83-e4e070bf0405", "sighting_of_ref": "indicator--9b03244c-a51e-4352-855b-4918a6deaa4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10033b4f-b447-46be-b776-2a693de26d93", "sighting_of_ref": "indicator--3b162376-d2f7-4350-a2b6-7668dd28eeab", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e8ad84-4a28-400e-b32e-802aca61472e", "sighting_of_ref": "indicator--40239e52-3931-4544-9ff2-150d3a2b03aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7790bbd4-34fa-443f-bf0a-ede0efa94882", "sighting_of_ref": "indicator--d15cf132-b758-4dd8-916a-02f04fed321e", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da557406-c356-4a11-850b-5e38e42b7cb0", "sighting_of_ref": "indicator--c8a17e73-7a82-487c-9641-0b78476c7e65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c99acc-7565-4f97-ac57-bcb19c7771eb", "sighting_of_ref": "indicator--afdafd85-520a-4815-ba1c-8d5425aaf333", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27820c5f-2d6c-422b-8a12-1a36ffd07427", "sighting_of_ref": "indicator--d2af9e3f-2daf-453d-80f2-0908689693b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be06d484-dfb1-478d-a050-41529efdcd26", "sighting_of_ref": "indicator--f94277e8-1655-42ce-a64a-422659a12c12", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b1e79e-871b-43db-9c3d-1c2b0ff354e9", "sighting_of_ref": "indicator--ad5f1e19-651c-4f65-8c3f-ca64512d7339", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a542cf5c-50cd-42ef-8b91-423920f7eab7", "sighting_of_ref": "indicator--06311e96-7bca-4786-9073-737c42c993cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd71fe47-ef95-4635-b63d-2d2c5d6840a4", "sighting_of_ref": "indicator--9b8aa3e1-35fa-41b6-ae95-3a49fdafe428", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a55c8b1-5b37-4871-88ca-254fd5c3afb6", "sighting_of_ref": "indicator--118a14aa-e356-4b85-88dc-641fcda2ebea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c119815a-c0bc-4177-8ab9-f7863e65feba", "sighting_of_ref": "indicator--236c69c4-f52c-4cb1-8a60-37efecb7be4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd6ef9ee-556c-47b6-af5f-5d06f5b23f95", "sighting_of_ref": "indicator--bb1f6fc2-11d4-49e8-a780-f542cfedb3a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--432953c7-ca9b-4756-b49a-51621ed40b53", "sighting_of_ref": "indicator--9315f9b3-9637-44e7-b759-8f92367ff33c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2032df77-9ee8-4f52-bb2e-f4b59adbba51", "sighting_of_ref": "indicator--1207946d-ddf8-4451-b392-de38f44275fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b567bf8-61ef-4695-885d-7c3cbe71acec", "sighting_of_ref": "indicator--14d0aee1-b636-493f-95e3-8d90663ed99b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82a246d8-0868-42a8-aa53-193fd3ef7e03", "sighting_of_ref": "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d420e1-14da-4168-9af9-f82c34209067", "sighting_of_ref": "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--522953f0-4953-43fd-9d4d-8230cd4a90ad", "sighting_of_ref": "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb3b9cfa-43aa-468f-80f7-e8a50669fa65", "sighting_of_ref": "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7b8a9ed-b88f-4357-b9cf-0a376a7ef302", "sighting_of_ref": "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffc8f736-f109-4569-8195-945a97663fcb", "sighting_of_ref": "indicator--08651289-e06e-4592-b5d0-675e876940bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3484e54-5de0-4845-af7d-fb5560f571a4", "sighting_of_ref": "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d50e8a4e-b6f6-4448-be87-e1b659e6c2b9", "sighting_of_ref": "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f45ae60b-7bcf-4424-8365-f1c1f704b685", "sighting_of_ref": "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a491e8f-2ab0-4ca8-8ec0-7ed32aa89895", "sighting_of_ref": "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd13e9cc-210d-40aa-9f4c-6e85ea594009", "sighting_of_ref": "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23539366-3616-4c1f-8569-51779d80dcbc", "sighting_of_ref": "indicator--c90ef75c-e3b6-4781-ab99-1a17dda17baa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6439eb-40f1-4133-b84a-bea49752c3da", "sighting_of_ref": "indicator--b18e464b-a476-4d74-993c-b836c0fc17dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88f244da-03a9-45b6-8518-4772c2cbbb13", "sighting_of_ref": "indicator--d78963f3-a4c6-4b94-8f8a-26a17ae49b2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4028409-2191-402c-a3ed-5fd44045e5b8", "sighting_of_ref": "indicator--dcf618a8-5554-408b-bcc1-833e1d172f7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a8f9d19-8a53-456b-96a9-770692f738ee", "sighting_of_ref": "indicator--174b5680-9cc1-48fc-ba5d-f64a5598c227", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59abfb9-2998-4841-bbba-72580c15733a", "sighting_of_ref": "indicator--0a94214d-ed92-494b-8cbe-a777dd442ce1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f801338-8766-47c0-be80-9ec7f6da82ee", "sighting_of_ref": "indicator--37eb6c4a-bf65-4ae6-87fa-f67afadd1e9b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e6b1fe-6480-4c91-8eab-95a2c7556b77", "sighting_of_ref": "indicator--f564ecf3-d76c-49ef-9e08-d6d68e1cea6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a2e33f8-e03e-4f74-abd8-e7003dfd41e9", "sighting_of_ref": "indicator--d73a3529-87a9-4621-8cf3-a2c6823d0a80", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d922a2ef-cd73-4933-8765-f84a3e1c0da7", "sighting_of_ref": "indicator--30f2046c-2e28-41a2-b60a-a659581f06a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647cbf51-bc1b-454e-9933-703fbac868bc", "sighting_of_ref": "indicator--66f13a84-d2eb-4f7e-9e9a-5fcb4739a548", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737e2421-8c02-41bb-9986-3933130b01f2", "sighting_of_ref": "indicator--30813f15-1be8-4686-9ddb-55a5a96854a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3987189a-3ee0-475b-8f50-3bd91c4f6429", "sighting_of_ref": "indicator--afe7107e-527d-4ceb-9a90-59b214f0cc74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a580dab-4e38-4af4-bea9-59c2d467200d", "sighting_of_ref": "indicator--73b8f382-3b0a-44e5-87b4-6455c685acd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf7f94b1-19aa-45bc-9048-c65e9b68a3c1", "sighting_of_ref": "indicator--a7d6728f-21a1-4c7a-974b-d85de4fbcb77", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d471d8c-7aeb-471a-9534-ea63777dcb7e", "sighting_of_ref": "indicator--34432e22-3f68-4892-b39e-b37dff09fc61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2222c03-c961-4849-a530-4a6e0af63347", "sighting_of_ref": "indicator--3f2fd16d-5c88-4089-bd06-7c32aaef6cc2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7737c6-e88f-4e38-ace1-f4f120b17b71", "sighting_of_ref": "indicator--aa82ff6e-0a92-4406-aba5-619bb0b3cd33", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72fcfc3b-0bd8-4ee2-a055-94b1ada65e14", "sighting_of_ref": "indicator--da1e0e6f-a393-4e9f-b57d-afab0e36d825", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae4bb8de-69d5-4b1a-85fb-00adce240ceb", "sighting_of_ref": "indicator--40bf84c1-ff60-489d-9f10-b6cdc32f265c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efd0494d-d766-4da8-a2a8-3c6af8ec9d56", "sighting_of_ref": "indicator--ea615564-28ac-4dec-b5a2-301530777974", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdee3d82-128c-4364-b264-4f326b32f6ed", "sighting_of_ref": "indicator--64083fab-ab4e-41d1-af67-80641f4a5b72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27bfe62f-d7f8-4c09-9052-c45e3eac43db", "sighting_of_ref": "indicator--1de552a9-08ae-4bd5-912f-a1fc1f01b9e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3eed805-ca72-4b56-a302-eb83bf08bbc7", "sighting_of_ref": "indicator--c4ff4837-9048-4d89-bbc2-efa831964363", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc531bbf-c71d-4d29-a211-988e78eb758f", "sighting_of_ref": "indicator--c4aaf557-22da-406a-8599-fa3d2ca1a052", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0d44de-4cdb-4ebb-9b62-2b5aba81a2da", "sighting_of_ref": "indicator--a5edca67-1593-4742-96d5-54a6e0fcf24f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3745d923-b613-42c5-ad3e-990ed066a549", "sighting_of_ref": "indicator--04252243-65d6-4cfc-b077-e448d9f193a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a75c724-8886-4416-8df8-130c6f7c5130", "sighting_of_ref": "indicator--c8248f2f-6930-4fe4-a0ec-559bbdb0c90f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc123aa9-f663-41f3-83dd-cc924f226095", "sighting_of_ref": "indicator--42527bb6-f039-42e4-b8cd-4e64878ed841", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be26850-4922-4b3a-9b1f-366e707b4c72", "sighting_of_ref": "indicator--abfda40e-d5e8-44a5-abd0-af2e0ec63a5a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f93cf37-1bf1-4cdb-b1b0-4ae836fee243", "sighting_of_ref": "indicator--8eac14b1-b2f0-4c17-909b-517da5fa6a72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8131eae-daf2-4e77-9138-d75382c8f843", "sighting_of_ref": "indicator--2cc76cf0-841a-46fa-b3ed-04c7535d03fa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b01f0dd3-5ba0-4e83-87b3-5e97e09c37f8", "sighting_of_ref": "indicator--8651be7c-e645-4123-aeed-6a2ec1c5d15c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5964eb-eb34-453c-ae89-b03f39e0c142", "sighting_of_ref": "indicator--58b1d5f0-f856-46b9-a011-c601fdc048ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1b8334c-faa3-46f3-9017-b2083f4a381d", "sighting_of_ref": "indicator--7cf6e116-3988-489f-a246-3c0c95f9624b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb264937-be89-4773-86d2-800734ba5720", "sighting_of_ref": "indicator--f2e35189-5f82-4788-9bbc-4eaf46687957", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adf54ac5-0ec1-40b2-b1eb-a4401b7cbd63", "sighting_of_ref": "indicator--d61399fa-857e-4511-8d55-fac9a9f75060", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2092792-ce96-4a3b-aae8-63995b8f3896", "sighting_of_ref": "indicator--415e13f4-2824-4183-96e5-910d81a7a85a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3b44b97-aa5a-476a-9a56-e6af394391b9", "sighting_of_ref": "indicator--02b5077c-69ce-4ef9-a2ed-863b9f58cfee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adeb29d5-5701-4d88-9ba8-fe130f7f4361", "sighting_of_ref": "indicator--bd41631e-535a-4207-8a94-8fbf9aca4ab9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f7f8d7b-e603-4771-a23b-e4e36d186d2e", "sighting_of_ref": "indicator--4271029c-7521-40e9-8728-4c7b9593a58e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccce9c9a-a4f9-4140-a1b7-cf02369c644d", "sighting_of_ref": "indicator--405ac2bf-a4d3-49ad-bed8-2e685d88b284", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--546afef9-f9f9-4a63-9e53-7384163b75f2", "sighting_of_ref": "indicator--b6f63558-03c9-476c-8a92-bc8072b3e71c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b998cddc-73b7-4a58-a3bf-da53f930157c", "sighting_of_ref": "indicator--9e36193f-5321-4ea8-b16e-c054ac98d65a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4969c2e6-3446-4b77-ab0b-7bd66e075afe", "sighting_of_ref": "indicator--099437da-019d-4333-a609-00f6e3164847", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e82de3-bf23-44d1-b638-12d2c2e25e99", "sighting_of_ref": "indicator--66f8493b-64da-439c-805b-42585786ccfc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e62f2454-8fb2-43ed-bc82-b6d28ac8f900", "sighting_of_ref": "indicator--a190d378-68bb-45e8-bac5-70b3756ab966", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bb546d9-1e24-4ab3-b942-7f715daad0a5", "sighting_of_ref": "indicator--c4ba131e-c6ce-4fef-a2a9-dd29504a30c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfb54708-ea05-4a42-a8a7-78eeaa3ed131", "sighting_of_ref": "indicator--ae7581ba-e4e4-475d-af2b-12509069cb19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca93b67c-aaab-424d-8378-006655d83a53", "sighting_of_ref": "indicator--8749331a-3c1c-4f71-ab73-d07b7621e3db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64752391-b9d9-49fc-a9e2-310d8c76cbe0", "sighting_of_ref": "indicator--53e79b4e-b47a-4fb8-bce1-5a650acdcc6f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce9d662b-5884-495b-a210-c6f90043ade2", "sighting_of_ref": "indicator--1fa57680-1de4-4d8e-b4f1-41b0f10782a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84cb152e-d08b-42f0-9df7-4ccba7651c46", "sighting_of_ref": "indicator--dbda70bc-9eb1-413b-9e88-f0512d73a43f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6fb835c-4dbc-473c-9485-4769e329ee05", "sighting_of_ref": "indicator--929c26f8-c170-4ddb-b9c0-964498b5c766", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76dabff4-d4cd-417e-88f4-a816c0dc1fe3", "sighting_of_ref": "indicator--7d58eeae-052b-4342-9493-abad24f058ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca5b1118-0b97-47e2-860c-52c63f24e704", "sighting_of_ref": "indicator--04ea2084-7348-4248-80ec-64824cdfa3f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6072536d-3587-4efd-bf45-76e1f0472e1d", "sighting_of_ref": "indicator--876312db-875d-490e-939c-639ada9d135f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e114a5-99f5-4c7d-8c4f-dd7a7904a506", "sighting_of_ref": "indicator--5181a423-0644-4c88-a698-a69870a861fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df33dbc-368f-4b84-81bf-5660430dd6fc", "sighting_of_ref": "indicator--e76e940b-e604-4a43-9e6f-489bc9b0dfea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ee9c9b-2b54-45e2-8ef9-4d2dfa891eb8", "sighting_of_ref": "indicator--4fd8dab9-dfb8-4199-ab03-719fc6110457", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39dd4cfd-c4ac-4224-aa0a-ada92e11f7a7", "sighting_of_ref": "indicator--45826fa3-d837-4a28-bc8a-9d33245e2d2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--355180bb-1909-42c2-8cd5-d880269aad35", "sighting_of_ref": "indicator--666a97dd-cc55-484f-90fb-364625e1debb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--563e44cf-fc17-436b-a97a-30a62f97be12", "sighting_of_ref": "indicator--b246cea0-16f8-4787-96a4-ed080f60d51e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e30285-b65b-4fac-b8cf-54b65e8c4d1b", "sighting_of_ref": "indicator--bcc2379e-d496-483d-ad9a-b6bb6f757bfb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a72556e-a804-4a54-b32e-9ea459abf84b", "sighting_of_ref": "indicator--a27cb2bb-3ca0-4811-a9cf-e91f70e39851", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24bd42a6-19cc-43fb-85a8-ca4cea6b1dbd", "sighting_of_ref": "indicator--758d499a-17bc-4961-b7c6-7f23a3aec932", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f946555-06ba-4f79-b452-4d370782531c", "sighting_of_ref": "indicator--7408b79b-0997-48eb-9137-074b87e2aebc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56b79e99-2c44-477a-a09b-b8580246ae3b", "sighting_of_ref": "indicator--e3aaa5fa-4058-4d1a-b123-c66c16f45cd8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba6766d8-52be-4b6c-95bd-290a8c87222d", "sighting_of_ref": "indicator--639e3e34-e6b3-4d3a-b55d-847c6fb2711a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f93b60f-d919-42e8-973f-5219fe029aff", "sighting_of_ref": "indicator--64f04304-9845-4b08-967b-603554268c4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02c10888-8543-42d4-962e-79747357b2be", "sighting_of_ref": "indicator--b2e55c3f-35ef-4589-bc85-a9f161081e74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2adad62-41ca-4cca-9e41-72f51e38a990", "sighting_of_ref": "indicator--55826723-2a8a-49f8-8084-2621e49d3d15", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94bdb94d-2e8d-40ba-8244-95044eff841a", "sighting_of_ref": "indicator--608fc8c6-0d9d-4f4c-97c7-25caeb0a6eb4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a74bdfd-828b-4165-bf31-a584f348da1c", "sighting_of_ref": "indicator--341045e7-a8e5-49a3-b3fc-acfc4e4b4e6d", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18bad9e9-d19a-486c-9b9b-ff620e84c1e9", "sighting_of_ref": "indicator--341045e7-a8e5-49a3-b3fc-acfc4e4b4e6d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67aefd1e-3c7d-44ed-b3ce-6350c56306bb", "sighting_of_ref": "indicator--535c47dd-8b09-4699-aafc-8c3ec8ab978c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d9441cf-735a-47f1-a739-3803eb7f7e82", "sighting_of_ref": "indicator--fca442ce-c99d-41ef-b235-52c629b00e21", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c5c0982-6678-433a-b60b-a4f3facf4d2f", "sighting_of_ref": "indicator--28451920-ac97-400a-82d4-457ed7d71ced", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e35de2-0c06-474d-92ba-aa608670aa96", "sighting_of_ref": "indicator--7c81c485-9583-4907-beaf-02ae768cdba7", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--723892ce-4f8c-4f25-8c9a-0a9c911919bd", "sighting_of_ref": "indicator--71d1d97a-9453-4e4a-b669-5f29f786c7cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01ccf7f0-2b5f-46c3-ad10-f8a22bab162f", "sighting_of_ref": "indicator--36f10d22-97cf-41e7-bacd-9d85988586b7", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48119166-db60-44e8-a641-f5ad7fb6982c", "sighting_of_ref": "indicator--38cc06ce-3b96-43f7-938a-af65ac2fff1f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53633632-7eab-47ce-8ce1-1c80a2d47f72", "sighting_of_ref": "indicator--5adc2e62-c17b-4991-baa5-f76e68999305", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e97719b-0d74-4f1d-891f-19cd9196268e", "sighting_of_ref": "indicator--09c56a41-3333-4e30-8024-6a418b7692fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f55f42ae-5469-4d43-b8ff-dd9a32aff615", "sighting_of_ref": "indicator--c0f6a24f-ecc1-40aa-a8dd-46caebbe1d16", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db8f6e00-90ba-404b-bbee-f75855ed06e3", "sighting_of_ref": "indicator--d27e44cf-ae0a-4341-aab1-6cb53c24de87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--208c8793-5e34-417a-8760-34c08c106b6f", "sighting_of_ref": "indicator--7fb0fbe7-b43f-4545-b964-24f8b5a3b51f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71199481-bc1b-41a3-a3e3-ffe68f3af820", "sighting_of_ref": "indicator--f974ef8c-7f58-4d11-894c-a3ef300d5f6f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9dc9cee-5574-4929-be38-e24ca659aebe", "sighting_of_ref": "indicator--d5bd5648-8146-4279-88fb-42f857f501d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a37ff86-1ba9-4461-b6f7-67ad0cd0b633", "sighting_of_ref": "indicator--432fd0be-08a3-4147-9559-337a87d57ef5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d428527-6d63-49c5-aee0-667c01856fc6", "sighting_of_ref": "indicator--f67eb867-46ec-4dbd-b8d1-497d9c342e67", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34eeb7ba-e944-4eee-89de-26a3a72a2df1", "sighting_of_ref": "indicator--cad2c222-3b32-4361-91e1-b3ac51c98065", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d291e23-46ba-4e51-823d-42f0582a3229", "sighting_of_ref": "indicator--2f799f04-782f-4ecd-b914-6c8c2194399f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b013da4-64f6-45df-b768-bff570431949", "sighting_of_ref": "indicator--8f15997b-575d-4898-bb8a-23c5d9c3896b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14519261-c4ad-464c-b5dc-a339a4d77a46", "sighting_of_ref": "indicator--62bb2af6-79e3-4050-bf2a-10a2a0d11713", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e28a1eba-9f89-470a-ace4-393ff45a39db", "sighting_of_ref": "indicator--40d547bf-65b8-4f13-ae62-4c7dce65ac07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1b2577-29e9-40b6-88fd-b92d28fcbf82", "sighting_of_ref": "indicator--a85953a1-1e1f-45ed-a350-7859f4f03248", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e27f11c-124a-4496-a08e-1f134e25e994", "sighting_of_ref": "indicator--aae419e0-8733-4bae-b17b-5a64f94771d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b5ba9d-3df4-4c38-80e8-4db255951d7c", "sighting_of_ref": "indicator--a8deb122-0b13-4684-9120-48e079d45db1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c363cf47-18a2-43d6-bfa8-eec1a5039f29", "sighting_of_ref": "indicator--27b3c194-91b1-4d7f-b2fc-776e67c651ac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f805a67-0a5d-468a-bccc-7059c540cf04", "sighting_of_ref": "indicator--1267f994-e658-453b-91a0-33ba6583872a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006b2736-7071-49eb-8af6-d99a4b394d1f", "sighting_of_ref": "indicator--c5eeb423-4e8f-40d3-91e5-8fad233c1596", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c139f98-bc5f-46f0-805f-47afc8d8dc0a", "sighting_of_ref": "indicator--c5eeb423-4e8f-40d3-91e5-8fad233c1596", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4371c1c5-70ec-4493-988f-ec5c430214f0", "sighting_of_ref": "indicator--b4325bd6-3a34-4eb2-9b30-d869f38e546a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1761c977-b571-4bcc-a0b1-c20eb6fbe2fe", "sighting_of_ref": "indicator--3de78abe-fb41-4b54-b87b-3ec14d0bdc0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ca87dfc-32b7-4c6a-82f6-da62b3f17f87", "sighting_of_ref": "indicator--60444e10-337b-4c22-aa39-b07bb17b51c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64faa6e8-d173-4206-9daf-fd28432c00e2", "sighting_of_ref": "indicator--217feb73-2917-44bc-b145-ade8b1d2fc73", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0524e9f7-d553-46b6-ab9f-6dc5f810ee01", "sighting_of_ref": "indicator--f97310ae-0061-4394-bfd6-f52f8cc2dc4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b831cdd6-72ac-44c6-b03f-33d2e555ba09", "sighting_of_ref": "indicator--a5d8ebc2-63e5-4d96-9ed0-f61ac51a9775", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7858df65-923c-41db-87ee-18382adc91a0", "sighting_of_ref": "indicator--ae74a084-e8f2-4180-a11a-9384efc54c64", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--860e255d-c723-47f2-8964-82613acfd5cc", "sighting_of_ref": "indicator--d25cb624-333f-4a2d-97dd-eb2a96ba7ff2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eda6c67-24fc-4389-9945-b21371f91004", "sighting_of_ref": "indicator--d25cb624-333f-4a2d-97dd-eb2a96ba7ff2", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8824528e-8948-4841-93ae-3b037ce7c1d5", "sighting_of_ref": "indicator--759128f3-5b81-4049-b67b-19531c5abd33", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea95bbb-0441-4493-a9be-3572c048d02d", "sighting_of_ref": "indicator--7428059f-ac8d-4fff-ba57-7bb79cc03d41", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe5cbbcb-e085-4b57-80b9-424264a28db0", "sighting_of_ref": "indicator--65d088da-24bb-43ed-a556-ed7a29285ed1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83be96c1-9b94-4d60-822b-42da96397529", "sighting_of_ref": "indicator--92fcb14c-7377-4fbe-a89a-ed11c68bc40d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47585963-eada-4ffa-ae20-4218f4e95a03", "sighting_of_ref": "indicator--4f4336c3-1d9f-4879-bb1a-9637f282a73b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a417ea8-2564-4b4a-a490-a183aa499542", "sighting_of_ref": "indicator--985dc409-1571-4ed4-8ef0-fa9de23ce6f5", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57e9760-629b-4cdb-a52c-f153f8f1796c", "sighting_of_ref": "indicator--e6a91b2a-8902-4dfd-8452-b7612ccbf45b", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a9f7410-b634-48d6-8ae5-edb06dd04bea", "sighting_of_ref": "indicator--ca48025c-2710-41e3-b7a9-b2d462785d11", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--393c8d25-1c43-4538-b28b-af870aec8789", "sighting_of_ref": "indicator--5e32d42e-1b19-4a51-a327-5e877069c5d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fcb3c33-c22f-4630-855a-b0346c68a1b9", "sighting_of_ref": "indicator--95d09e52-bc53-4cff-8ee8-d8fd9626b4b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8538951-e3a3-4bbf-83ca-47cb36aca7b5", "sighting_of_ref": "indicator--87a349eb-acc7-4ed8-971f-ad87691a8773", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7adbbc5d-1761-4f57-bb51-58b9741a1fc8", "sighting_of_ref": "indicator--87a349eb-acc7-4ed8-971f-ad87691a8773", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce390af-39b3-43d6-8e42-f7858c98a8e1", "sighting_of_ref": "indicator--26cf66a2-ae99-4d39-ae28-de51d816bcc5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2172fe65-f70f-4e15-a919-c5a3343583af", "sighting_of_ref": "indicator--cadf5029-6d14-4a63-a710-39f8e0be7091", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a08a9634-cab9-43e2-a9ec-e94da483544e", "sighting_of_ref": "indicator--4a8c3d81-68fd-4819-a10c-dcef3007c9a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c12575-2d6d-49a1-ba1f-ba8589ce22af", "sighting_of_ref": "indicator--df2b7c25-5ddf-41a5-bd71-18792f684281", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac479f8-ea34-46e5-9ab1-84afe53b651b", "sighting_of_ref": "indicator--389db86f-d394-405d-9f0d-b313ab113f04", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--822d3f50-902e-4e31-8d86-83e42e1bbab8", "sighting_of_ref": "indicator--db9ca23e-ba4d-49a8-b39c-ef1b7bf6fb97", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657f6feb-5c68-4360-8303-e53ed1a90627", "sighting_of_ref": "indicator--a6140b08-8880-4e4e-93af-79cbe65a7b0a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d6b6824-77fb-4c75-8510-92b5fc838bcf", "sighting_of_ref": "indicator--85ee26aa-8887-487a-8bee-040893d0f437", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c59083cf-bd49-4405-8148-7b8c5b6e7b18", "sighting_of_ref": "indicator--84bd1545-e6d1-451f-a762-fef3ad550581", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a781c85a-68e4-491d-b521-71b936d917f6", "sighting_of_ref": "indicator--a2960a71-0f8a-493d-84e3-2db72eb7ed44", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621c07f3-5293-49b0-8daf-f03e5937894e", "sighting_of_ref": "indicator--90d95969-76c8-4453-901e-a99bf78ae23d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32279cfd-25f1-43d9-b5df-dca97e3b3a37", "sighting_of_ref": "indicator--a082d53e-d484-4f01-9562-6ed38e70f997", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d52081-3b95-45bf-bdc7-74ddd0bcda56", "sighting_of_ref": "indicator--402d785d-b0ce-4068-a3d2-ca42bac085b9", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76e5bed-4699-4316-bd9b-f81236965787", "sighting_of_ref": "indicator--b9090e5c-a029-4b21-a940-4e145d561439", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9b3967e-ba50-420e-9299-b859246761dc", "sighting_of_ref": "indicator--b9090e5c-a029-4b21-a940-4e145d561439", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a0a1773-16b1-4fff-ae18-ef2965544d1c", "sighting_of_ref": "indicator--0a5570b8-fd15-42ca-a3a3-de0c113d4231", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb164fbd-2fa5-4cac-b575-679512ba695f", "sighting_of_ref": "indicator--a7fed5f9-a103-48f0-8b8c-6ce6b4575a53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded91611-7a51-4ce5-936f-20757802d302", "sighting_of_ref": "indicator--80eabf92-e047-4add-bb33-2c18a0457c7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df09dbb5-0875-4ec7-8c86-391971966b5d", "sighting_of_ref": "indicator--d89d3e4b-df8c-4ad0-9d8d-56fe99d6e59a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66faa466-a5e5-47d7-80bf-2f5721229915", "sighting_of_ref": "indicator--ab16cab2-6458-4497-8248-a6c3ef198cd6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--225b58c8-1bff-4c72-8305-fcb08413d796", "sighting_of_ref": "indicator--5280fb8f-5d76-409c-b564-e6fbde0ba8d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d47e250-0bd1-420c-ae5e-8e894bcf1f3b", "sighting_of_ref": "indicator--c00ef7af-80bc-4d7a-bcb3-553cc6675f09", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5fe3fd6-ef93-43a5-b6dc-d88c07b4af6a", "sighting_of_ref": "indicator--c00ef7af-80bc-4d7a-bcb3-553cc6675f09", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26f856eb-c360-4688-9ae0-611a2ff9ac6f", "sighting_of_ref": "indicator--83be64b7-4b07-4c5b-9f37-aa1a3275b466", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33323cc8-494e-4124-99e4-ebbebc33ac9c", "sighting_of_ref": "indicator--3372a415-98a6-4a5a-aa01-43041094687e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff6f732c-55ae-4677-ac30-8371fd9bf855", "sighting_of_ref": "indicator--64461d40-4fb2-48d7-b8ba-54f13492c72a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5752433a-f3eb-4b54-b44d-f62a806bf4cc", "sighting_of_ref": "indicator--94b944ae-9fe3-4a0e-82b4-7c479b2bb903", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f5b820e-a118-4f20-bc16-a9b62524b182", "sighting_of_ref": "indicator--74e984f7-c9ac-49df-9062-2174d47367d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88e56209-b93d-44fc-99c6-dd9678adb84c", "sighting_of_ref": "indicator--83b7ac34-aa00-44b6-b052-408f0be527af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--142d98f3-5928-4505-ae72-6d4228477a58", "sighting_of_ref": "indicator--4aea3e42-6076-4365-957f-e22863c3fd03", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7ba6b13-945a-446f-a108-37114f951aa8", "sighting_of_ref": "indicator--e841c0c7-6051-4334-ba93-781f97088c84", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aaa948d-420f-48c4-92d8-512e9064675f", "sighting_of_ref": "indicator--949431e6-318f-4198-9f4e-20618a8e9baa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc15235f-8786-4864-ae70-7453df2e711a", "sighting_of_ref": "indicator--c2807ca2-1731-4781-aabd-a0449ae3fa23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3964efaa-f2dd-4611-9610-d1d3053f6e67", "sighting_of_ref": "indicator--c2814c59-4570-4831-92ab-c5e128085c19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec788ace-8b68-4322-8a97-8d126b901755", "sighting_of_ref": "indicator--cf5c8bcf-842b-449c-883e-d50fd969cdb9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f7c618b-8b17-4751-ae66-631ddb5bc37d", "sighting_of_ref": "indicator--59d53248-a697-447f-9985-699258c6bbcc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--207b6d1e-d58b-427a-964b-3d6ab4f6ceaf", "sighting_of_ref": "indicator--52aacf5a-b180-4ba4-b8d2-089d57744e3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5657d09-9ac7-4954-8fba-4e666d70363f", "sighting_of_ref": "indicator--da666e51-e1c8-4d58-9a0f-bd1dab880082", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b234f0a4-b877-4156-bfe6-3b6c03dd2db2", "sighting_of_ref": "indicator--599f1bd2-c444-4045-8deb-00c8fe56c589", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9704bbc-670c-43c7-917b-a3a58bcfda7d", "sighting_of_ref": "indicator--bd392572-7736-40b4-9b2e-e112f2797b7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e5690c9-110d-4cbc-b1bf-f0c808bbdb10", "sighting_of_ref": "indicator--6f1fc813-bdd9-41aa-bb33-34349b559447", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--923539cd-ced0-4165-ad13-f38bab5d9746", "sighting_of_ref": "indicator--e17dd8bd-76e8-472b-852d-13fe06fb02e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56b7bc18-0556-4798-8a1a-8daaf63e19c1", "sighting_of_ref": "indicator--c5ab33bc-c80c-407b-854e-441f41620ee8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3d12c69-211f-414f-9454-f1ff9b658bdd", "sighting_of_ref": "indicator--c73b5457-bae0-4b80-8cd3-620312280b23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d1b6ea9-1e9d-4c41-93fc-0ede3c3d0b92", "sighting_of_ref": "indicator--00d68712-6f9a-4ff8-a7d9-b347a7234ee1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d943596-c147-4974-8ef9-2574c38ddbb8", "sighting_of_ref": "indicator--10ce28bc-c376-4252-8439-11e7be9e00ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291c1c88-245d-4bfe-91b9-2345927a23f2", "sighting_of_ref": "indicator--9d5af20e-e9ce-491c-abd0-d6962db91a89", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dc6c6c0-172d-4f17-9ee4-3c59acbfdcf7", "sighting_of_ref": "indicator--1c7d6530-971b-400c-bff0-739b6710f2e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be61b65-af3e-4d92-b407-1077db1d5185", "sighting_of_ref": "indicator--84b34cfb-6558-4c80-90e2-c9098c4de214", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c752ee-9c50-4127-a20f-c31132da5dff", "sighting_of_ref": "indicator--f69cffd4-2fda-40a3-96ef-f21fe706d672", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c81623b4-0a7f-4680-833f-83d9fc900849", "sighting_of_ref": "indicator--593739bd-7172-4a7d-8896-ca9bceea63d6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3642f53f-73d3-4f92-844b-8237bd36d22d", "sighting_of_ref": "indicator--0ed8c94b-b173-4c15-a4f3-d982388590c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd394c03-f921-4f34-984d-735d9b49b89b", "sighting_of_ref": "indicator--93fe9e14-c8a3-4c63-8a66-5a6a90a7162c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b6e2af7-3929-4d46-8d8b-b0d06bea4dbf", "sighting_of_ref": "indicator--22aee456-b02f-445c-96be-2de07adde525", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e598345-922e-44c6-9558-94bf827776cc", "sighting_of_ref": "indicator--22348361-9c1b-48d9-b6d8-a8f27e28a227", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04ce7011-62a0-46b0-ad3b-98133300938a", "sighting_of_ref": "indicator--87b94073-c427-4e3d-a7ba-c2d876c26ff0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--881b62ad-63a5-4154-96db-d457229ca02f", "sighting_of_ref": "indicator--2056a8c1-1154-4acc-87af-0c220df9cd1a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f0d4f7-efee-4688-b434-3e58db44fcbe", "sighting_of_ref": "indicator--2952f083-c15b-46de-bd9c-ecaefe3eded5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a626840-f820-4669-ad14-f67beb52ebfe", "sighting_of_ref": "indicator--b04bfe87-b3ba-48b1-9bb8-df97ad267ec3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52f3f809-603b-41b7-8750-74feb06efe11", "sighting_of_ref": "indicator--ed9fe303-6332-440d-b4d5-57dfbacd8b9d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6ea816-6a49-4e5e-85c2-3db9e1f51347", "sighting_of_ref": "indicator--4b94383e-c26d-4ef4-9f54-127191525245", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44a1f9d-8dc5-4f21-bf4f-c88c41e99655", "sighting_of_ref": "indicator--bdd12224-76ab-4fab-acbb-b129bf247822", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117e9dd5-c06f-4e86-8b6d-8528e7dabc1c", "sighting_of_ref": "indicator--8ceb2b66-f954-4e59-8295-02b3d5a0fe3c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--400eae5e-3da1-4360-be9c-606e562a57f3", "sighting_of_ref": "indicator--9aa0eeab-e9a1-4bba-a105-04c0b6908e7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acf5966d-40f1-4c43-b772-ac458e12c5b9", "sighting_of_ref": "indicator--67e084bf-fab5-42ae-a92f-cd8a9302007e", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbe2a10e-3ebe-49a3-8c17-7a184ea5e61c", "sighting_of_ref": "indicator--67e084bf-fab5-42ae-a92f-cd8a9302007e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce32ebba-7d4b-4b3e-853b-b45b34cde69e", "sighting_of_ref": "indicator--67e084bf-fab5-42ae-a92f-cd8a9302007e", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42c86812-40ab-481f-85b4-22ee412e69e4", "sighting_of_ref": "indicator--ef25aa51-7375-4967-b00e-bbfe9bda8eff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c968ea7-db23-4081-8305-0a1ee7cb95bb", "sighting_of_ref": "indicator--8c10eee9-39f7-48aa-8656-600fe5e7c8dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6607ac7-22ca-4a4c-9a71-993ae8f72980", "sighting_of_ref": "indicator--b9b09d5b-7954-45dd-a678-30339dc011b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97c7dab4-be62-49dc-bf01-9ff483ec2ed5", "sighting_of_ref": "indicator--910e5e3e-c79e-412b-8acf-a9e848488eb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d02f7a3a-1331-4a1c-8bbd-557fc85f41ef", "sighting_of_ref": "indicator--ffd3411a-1512-4162-8db8-ad140b7184da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b2cba03-c8ea-46d9-8208-2969f6b2946c", "sighting_of_ref": "indicator--202f7584-81aa-4d7a-a304-77e5cbf04f13", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74198fdd-c7d8-4cbb-b89d-efa63c0c25c0", "sighting_of_ref": "indicator--474e0777-723a-49e0-b30c-29111dd7972d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d29fb93-260b-4de0-a241-80a593f74e9c", "sighting_of_ref": "indicator--ecb9d607-c293-4e69-8f5e-532977a25cc1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7866164-6aef-4c06-a037-fb204067f847", "sighting_of_ref": "indicator--2d70a59c-8891-4f87-938b-0e52089913c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--688f1d2c-9d44-470d-90c7-7deb1c1553fd", "sighting_of_ref": "indicator--bd9f2a05-ae7c-4e70-92ca-c5b227097cd4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13de5416-2d1b-4c2c-ab28-13cfb1f68eb2", "sighting_of_ref": "indicator--151159b4-da08-4ea0-8bbb-a13ccb38f4fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12bfce1d-57c4-4fd9-adfd-22c7b5f6fe2a", "sighting_of_ref": "indicator--204662df-d96e-4b9a-ad77-8e3f696f043c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4485129-e508-4993-ba52-aee9802b6a6e", "sighting_of_ref": "indicator--e8d4c0eb-d1ce-43c3-8e20-f5282447ea74", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e584d40-bcac-4c25-9979-62aabd3ce1b2", "sighting_of_ref": "indicator--869a0617-fb34-4a74-abd2-dec8d5a3fe99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7871268d-bee2-42b2-b449-1e1f7aa939d3", "sighting_of_ref": "indicator--f0ad38a8-aa16-4312-ab7e-960c2b277353", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae7dd0b3-57b0-480e-a514-692f5c341f63", "sighting_of_ref": "indicator--df6ddd01-1402-487a-a4ab-9f4ff105e89d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3920281-fa2c-4e96-bf6f-6a2063fec5f1", "sighting_of_ref": "indicator--2c78539a-084a-412e-bc7a-e2b2c6cd8dc2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c413f247-e901-4eb9-8db2-fe52aec17fbe", "sighting_of_ref": "indicator--20cab1c3-d457-403b-a7e6-0e38b243b434", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb942902-3b19-46f8-a9af-9d6739772532", "sighting_of_ref": "indicator--decab3c3-e0fe-40d5-ab72-164ccdebbe7d", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc66c52-53dd-4349-826a-be03aae591a8", "sighting_of_ref": "indicator--46b1fd94-c1d3-482b-9001-721756a2bcf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd62e45-6020-4b81-841b-4d4ea5a404d4", "sighting_of_ref": "indicator--a2d89c3a-fcab-446c-87f1-464cda111014", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc308be0-0aa6-4f1f-8511-f86e04dfe28a", "sighting_of_ref": "indicator--5fda573a-0c9d-4f7b-887d-406d50312ec0", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b262cdca-6081-4ecc-a74d-76f7796e1315", "sighting_of_ref": "indicator--e0efe9c3-214a-4648-adef-0e7470cb3ea3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a948ae5b-29d9-48da-8d7e-d26674cfc4bf", "sighting_of_ref": "indicator--39d5197e-73d8-4530-a464-b3d3269a3281", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e3feca7-a226-416d-872a-cdf924d2fbc5", "sighting_of_ref": "indicator--43914aa9-1b3d-49d2-9f34-02f3e03aab6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f11fab8-444f-42ae-8861-d9df9e2720d2", "sighting_of_ref": "indicator--33cbeeab-bf83-453e-9ce5-41e5b01e67e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba53a009-e5f3-40b7-b797-218817dbf523", "sighting_of_ref": "indicator--5010713c-0c5f-4f1c-a6a9-98cd89e66b21", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef69b253-e14f-469c-ae99-0803447431bb", "sighting_of_ref": "indicator--1c53adb7-8316-4f1c-b68d-87602d4515e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce882d97-2315-4ae4-ada6-a9eceb3d4896", "sighting_of_ref": "indicator--d6fcd535-a6d2-4152-9016-bfd3483faf72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c50b60d-74de-448c-a2ce-c5b2a982230b", "sighting_of_ref": "indicator--bb717679-29fa-46bc-801a-e30f8b21b9c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d06e97b-cbf9-4573-814e-04a381bdb3e2", "sighting_of_ref": "indicator--a63ca40e-8d2b-4cf0-94f1-7c23426598dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54d3d2d6-37d8-4437-a444-4eba8722b518", "sighting_of_ref": "indicator--a63ca40e-8d2b-4cf0-94f1-7c23426598dd", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b8b650e-0d71-48cf-b24d-6c237dd63922", "sighting_of_ref": "indicator--5de354fd-aa89-468d-9633-cb8479453a40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37b9b8ed-2bdd-4e10-9a99-a54a10cac273", "sighting_of_ref": "indicator--1eae3cab-57c7-4380-8eb3-349dfd00721b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6a08092-4b6c-4b72-aad7-e7f49b6e0fc6", "sighting_of_ref": "indicator--6298a2f5-da08-4cf4-bf94-bfc331db4241", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce2a5398-f4d7-4a51-9996-c094ef93c69e", "sighting_of_ref": "indicator--30f589e1-3ae9-4801-9a49-8460ad6a39e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3421eb6-8619-4606-9684-75fb0f47920e", "sighting_of_ref": "indicator--8a23886b-426f-4a9c-af63-f92fe13aacfa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f058d8c4-3317-475d-b18c-448e6f0a0852", "sighting_of_ref": "indicator--178fe9f0-d078-4d1a-bbbe-6d44f45725ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22457832-749c-4611-a20a-f537c43bd757", "sighting_of_ref": "indicator--aac0561d-2340-4847-ae14-19e5957c6988", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca6e9bf-f331-45e6-a8be-d6f09faddb4c", "sighting_of_ref": "indicator--79374542-9496-4cff-a101-aa5b9b2aed7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cd9eb84-f47a-4558-a153-28df9a66c4af", "sighting_of_ref": "indicator--b927d134-61a3-411f-b116-4c9d00c228bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--573bef58-ff64-4b7c-b793-fd09ca407193", "sighting_of_ref": "indicator--84193a46-895b-461e-a802-d9f63b670d3a", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ac29fd7-5ba0-4e06-b6dd-e60456dcb482", "sighting_of_ref": "indicator--84193a46-895b-461e-a802-d9f63b670d3a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85162c86-d9bf-45da-99f4-cdcdae927e5f", "sighting_of_ref": "indicator--fc21d172-8b9d-4e7f-afb0-52c3709ee208", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--973f13cb-7ff8-4872-bee6-dd26171ea1d0", "sighting_of_ref": "indicator--9437c52d-7a28-487e-bc26-272ae5e6040d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df7f8ddd-e91e-4f96-a189-8579f571b586", "sighting_of_ref": "indicator--7d808d1f-95fd-47a2-9b0e-91bd2e70dae2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88804a74-c0f2-41e9-beb6-eacf63b5714c", "sighting_of_ref": "indicator--377b7440-d6ce-47f6-88c0-6718a18e4e79", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea68662-3bc1-4a65-aff5-bc3f44c0e2d1", "sighting_of_ref": "indicator--20140924-52be-448d-97db-eee14d66d070", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d47988d5-4d1a-479a-b664-04f044ac1bcb", "sighting_of_ref": "indicator--68c05067-8a89-401a-9db4-0d1b537b9477", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5119498f-97cd-4063-9256-ca73717ea259", "sighting_of_ref": "indicator--64980efc-9e45-4d57-b7db-8ffaf60adf63", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87c0aa5-d29c-4fbf-a427-2a73dc769957", "sighting_of_ref": "indicator--5655c358-cf4e-4500-aa90-a61750c75a65", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b4ad1e7-13a5-4ce4-afbb-600fcd643498", "sighting_of_ref": "indicator--b4da0689-fc0b-4e0d-b407-0913a069a918", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69bf9f36-48f0-4297-8430-f55909dd8552", "sighting_of_ref": "indicator--673e629e-bf73-449e-ae67-27d0ef5a4c92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c96124-b4b8-4093-97dc-da2c3a1f2c61", "sighting_of_ref": "indicator--7cba0c3f-deeb-4006-a3b4-84a108c5d9e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e80ba570-1714-4867-97ea-0932f103fedc", "sighting_of_ref": "indicator--5cb92f92-fd31-4a1f-9b3e-a7e220e80f7c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c438200-2617-4164-ad34-ddcbe8f6785f", "sighting_of_ref": "indicator--14133ed9-3b68-4d4c-b211-1d1e376c89d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd68950a-60a1-4743-b149-0cdcc53d3828", "sighting_of_ref": "indicator--604f8da3-e28f-4877-84b9-aa5892afe025", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2002061-f905-4cb6-b977-55b1d8e0f61f", "sighting_of_ref": "indicator--13503b0e-7100-4cd3-b1c7-05cc6f9bdb97", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2946eff7-c555-414d-8ecd-d7329575b434", "sighting_of_ref": "indicator--ea60a12a-f1ba-48b8-afa1-dc54fe462ea3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2e2bca-c198-421f-bfdc-8877f5c6c2e8", "sighting_of_ref": "indicator--54e1838d-664b-474d-a37f-aad96212ce70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7efd983a-14d6-41d5-a8b6-c9111fa18de6", "sighting_of_ref": "indicator--95fb4a8a-cb77-4d84-a233-d235c47900e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f755bad2-5d9a-4951-a669-aa2682b7d1f8", "sighting_of_ref": "indicator--e1d36a06-fe00-44f2-ac69-46b99e97e58b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d350666-76b3-4823-babd-eafe8d43ebef", "sighting_of_ref": "indicator--d1fb30f9-aaec-4998-befa-03815492a685", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36ba98f-2605-424e-b24e-71ac8c2625d6", "sighting_of_ref": "indicator--209975b6-9be4-41f5-a768-494af4d0a457", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d655bfcd-807c-48c8-b648-97e368153ca4", "sighting_of_ref": "indicator--40c94f85-d4ec-48d8-8618-474828364e23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba48e639-ac02-49ed-90a2-678a3254ac89", "sighting_of_ref": "indicator--a7e5487a-3ee0-4280-b3d1-3240d1d6a847", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4525673f-e1f0-4c7e-947b-7ca60a3565c1", "sighting_of_ref": "indicator--73d2f4e3-46c9-4ec8-9d85-59675b135922", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58a364bc-1cc0-4bcd-955e-5dc82308f6ce", "sighting_of_ref": "indicator--fccd5407-ae0e-4d1f-b200-1086cb5fd425", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751c2f4a-f5af-41ad-8cd3-7d52e5140134", "sighting_of_ref": "indicator--e40f2f90-b78c-40a9-b005-0ddce2f17d30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1e5982c-ed01-4182-b23a-f3f191f86aff", "sighting_of_ref": "indicator--b90250a1-2ab2-4445-8785-2ab473c17f59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--640e7a92-25da-44cb-a149-05a899c1d5e9", "sighting_of_ref": "indicator--34efead0-460f-4782-9859-2fe99e0ec0c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2dc7a57-f23e-4974-9a02-2246f7a05f82", "sighting_of_ref": "indicator--18f36ad7-21f7-4cfd-8a2c-ca39259595b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38594f9e-04a7-493a-a2b3-22deb180d079", "sighting_of_ref": "indicator--f351d786-daf2-460f-985c-b3fb76c655ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a9e7d6-3d5d-44ed-8dc4-46de43d65e05", "sighting_of_ref": "indicator--c293a036-e717-42f5-a304-087739e912ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c9a931b-268f-488a-b1ab-f12cd18284db", "sighting_of_ref": "indicator--f81a63e9-14b2-4976-b87a-58c736fcca1c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0b56b3c-3213-4007-809f-819c1147d503", "sighting_of_ref": "indicator--e0a11fa5-472a-47d9-b965-f79cc2b0dbf1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a51ddad-7d7c-4fe1-b71b-62ca347c393a", "sighting_of_ref": "indicator--37ecd574-f69e-491d-8048-f13b6e9d7edc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6562baf5-441c-44fa-8f87-cd1f4cb33084", "sighting_of_ref": "indicator--aad38c56-db2b-43f9-b907-e61f82c0e4a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4a06cb-46fb-47f2-b352-bc8a3e9c964a", "sighting_of_ref": "indicator--7c7ca684-afca-49ac-8df2-c0c7f4911ddc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3d173f-d0bf-4e41-9512-6146a20850c8", "sighting_of_ref": "indicator--611a07ce-406f-4abc-957a-c185e9e4104e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f67c17-43eb-4e6f-8296-b4f8a3a7a1ff", "sighting_of_ref": "indicator--34a386ae-7486-4e70-91ec-2a02ee10e423", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0d31b59-c793-41f5-82ed-1ddcbe6718b0", "sighting_of_ref": "indicator--6b3d07be-a2e4-4632-a0c3-3fce4b00094d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b519f1f1-07b1-4784-bcd2-99f7bf62fb79", "sighting_of_ref": "indicator--05fd53bf-dde4-4bef-b473-f002d1fcc6fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--660a4a84-d929-4025-bc17-9b1c15289753", "sighting_of_ref": "indicator--6fd8dd76-1efe-4d75-b5c9-833727eeec18", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--575ec31d-39e1-4a63-a714-c67bf9b14467", "sighting_of_ref": "indicator--c42beef2-90c6-4a8f-b37d-f9f30c945e5c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d71ad50-9e73-424c-aff6-b6f2554aa484", "sighting_of_ref": "indicator--6a828d91-2930-4fbe-b0ef-08141126509d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b29e78be-7ab9-4ae4-ab54-a7ef37c5645c", "sighting_of_ref": "indicator--aeb15dcb-1617-46c9-ae6a-39b12689b6f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4935585-20ad-48cc-9643-e645f1baf0dc", "sighting_of_ref": "indicator--42ae7952-5229-45d6-a1e8-4d839012c40c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f3660f-37c7-4ccc-90f1-3436757da8bf", "sighting_of_ref": "indicator--075fa10c-0747-4a6e-bbe2-6d4399b6d5fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a98258bd-c6bf-48e6-aa09-330d7aad5b5b", "sighting_of_ref": "indicator--e07a5b2d-f76e-4a45-846b-d28f69fe67cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e41c58d0-9282-43a4-a14a-15ae5305f235", "sighting_of_ref": "indicator--9f154c3b-1b0a-494a-ac81-58af9e184ebe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--773ed755-3751-49a3-93fe-0639269fcd20", "sighting_of_ref": "indicator--c8426f8a-5f2c-4e0a-af2e-7aa4e79c1566", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde7fb70-c569-4388-8fe3-38ac11a24015", "sighting_of_ref": "indicator--48818cb0-d766-4c33-9ba7-c8071b2d7a76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c67a66a-a3ee-4f4e-84c5-03489c1344aa", "sighting_of_ref": "indicator--cfb30408-c173-447b-a689-715dc1943356", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428cba7b-6e35-4dc7-a71d-f2356898a73a", "sighting_of_ref": "indicator--a595b726-8b3f-4218-9173-2e300561cd62", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1def716-6cc4-460a-86a1-ea1d44a78ce2", "sighting_of_ref": "indicator--8395f59f-3a70-41aa-b9f3-6b9663ddc5b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60692ba7-3fff-4d73-80cf-8a9408e43186", "sighting_of_ref": "indicator--2afca9fd-3af4-41d2-87f9-926be9eba7b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3358d121-8fa8-4cbd-bf6e-24336c68109b", "sighting_of_ref": "indicator--51d9166a-a7d6-4dbc-ae19-0b65afde34b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8e32e2-1a3b-49ca-aea5-43045bdf1a1f", "sighting_of_ref": "indicator--ed7cdda2-cad7-4eeb-a906-936a23a1f09e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94a361db-cd95-437e-a269-d398b9939dfe", "sighting_of_ref": "indicator--20306961-5622-4c61-bd3b-fb8f8cf0bcb9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f54d9eba-574c-4182-876c-7c13c54ee9a1", "sighting_of_ref": "indicator--91a81106-5456-4765-abd3-a0a07bc45cc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce21015-a537-4418-a4ba-3ac5fe04972e", "sighting_of_ref": "indicator--254c3ee5-e69f-426e-8bbe-3064e197f069", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2005c260-7364-4af7-9620-7797092314db", "sighting_of_ref": "indicator--c6992c20-f0bc-4fbf-948e-ebc998fa6fdc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d88d743-26b1-4d67-82bf-e55d1ded9871", "sighting_of_ref": "indicator--b6d5ffc9-76bd-4e02-b53a-98b8f63a8a56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b98e06-7210-42da-b1e4-ca733e8408aa", "sighting_of_ref": "indicator--52d5e092-3dd1-410b-bf30-cd2908ae8209", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfc67d8a-4f53-44cb-a6e9-c7d5e767416b", "sighting_of_ref": "indicator--b67ece35-74b0-4bfa-8c93-189704a5a2a5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0175ce74-5321-43b9-87f2-bce17eb739aa", "sighting_of_ref": "indicator--bcd21ad4-05c7-46cb-87f1-e2adb8dac10e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813e0c6a-7799-49a5-8e45-bedbd7f62ff7", "sighting_of_ref": "indicator--31b7ee7e-eb2c-4520-94cd-d4c0856a2cff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5142b097-4ca8-42b5-a329-6524c87f5551", "sighting_of_ref": "indicator--dea39062-b0f9-4221-b089-2b1d59a3f166", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da7d3684-d8f5-4a3c-aace-c7b11050d91d", "sighting_of_ref": "indicator--daaca6ec-b69f-410d-b442-e89033dbf95f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6af32bea-2f6e-435e-ba8f-be53774ee24e", "sighting_of_ref": "indicator--702b5f15-1453-48a1-bff5-d1e99bbc9b5d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d1f96ac-e4bf-4ca7-9ce6-b5f06cbfbd20", "sighting_of_ref": "indicator--c3bd110c-933f-4194-abf9-401429c21e25", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcc3fc1b-702b-46c6-975e-505ec9a86fde", "sighting_of_ref": "indicator--82121541-7d6e-48c8-93c3-7b6792540754", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed671ab7-4ee7-45c6-959e-cb5fe8e46543", "sighting_of_ref": "indicator--177783ac-d9db-4cf4-89fd-70fbe4c262dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2928f2b0-b5ed-4631-8346-9bda6f53dedb", "sighting_of_ref": "indicator--289f6cd7-7957-4980-a238-35178c66f79d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f574c24-4901-4835-882f-bf7061d945a7", "sighting_of_ref": "indicator--3514487e-f5f6-4907-acdb-6593057957c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fb13b29-c15c-4c5f-8871-3e9eac68047c", "sighting_of_ref": "indicator--5a653faf-40e8-40c7-8a24-68568031080f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb7f5e65-bf89-405f-973b-e6badf239e2c", "sighting_of_ref": "indicator--c3309da4-8bc9-490e-895d-3064bb8b268c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebe8fb94-dd93-4c66-934d-ef336a8cc22d", "sighting_of_ref": "indicator--087d5d1e-5ce3-4aba-bd91-223e1d64ff67", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8031f790-59c2-4f3c-842a-5aa1d671aba1", "sighting_of_ref": "indicator--7b628f15-1a2a-4520-a0c2-40030584a45c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d83368dc-3f0b-4904-8975-9a3ab871064c", "sighting_of_ref": "indicator--a4f78f2b-e293-4d85-adb8-ef7f8b124a79", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d195401e-6fad-47c2-9ee8-569b1f1511bf", "sighting_of_ref": "indicator--e39fb055-6612-4c80-9b39-b065a65052f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bb733d7-98b9-4c92-a97c-fd194d12c3c3", "sighting_of_ref": "indicator--eff5882f-cb1b-43d4-b1de-9fec7dff1d2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--446f5a37-107b-476f-8dc0-f1b02f4f5413", "sighting_of_ref": "indicator--92cf7cb7-8f29-4de9-bf03-4024a54b1ad3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6b4eb3-59d8-430a-ad78-a551bc212182", "sighting_of_ref": "indicator--3fe5475a-46ca-4af8-a459-18a7311ef2c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbfdcb74-3c31-4d70-9725-3ab5ed1836bf", "sighting_of_ref": "indicator--5af14483-092c-4ff7-b12a-e37821c2fa31", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d267165-4a5e-4a1b-989f-91043aa1b28e", "sighting_of_ref": "indicator--7ea1d8df-b2d9-44c8-b0c5-04f6b165c722", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54b8bdda-29dd-42df-b610-1eba7c03dd09", "sighting_of_ref": "indicator--11672e85-e7a2-4994-a6b5-210a460d8098", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--799561e1-76a4-4dc4-b72f-68ccb5d96f8b", "sighting_of_ref": "indicator--c6c972b5-d0eb-4e5c-9333-1ecdcae9d328", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba11e86f-d4db-408d-b350-0a6f4b7a0bb3", "sighting_of_ref": "indicator--fac5f3d4-f782-4cc0-8c46-d64bb9219383", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0d00b3f-7880-41b9-8fa3-23eab4c88804", "sighting_of_ref": "indicator--0acf6471-dd73-4c66-899c-da676c6b304b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541a1e2d-0caa-4664-b4ac-51646cacdc40", "sighting_of_ref": "indicator--739963d3-36f4-4958-aa68-aee97f7dd0a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1856e93-45c6-423b-a95d-839b814ecd3e", "sighting_of_ref": "indicator--b121bdc9-b335-4c49-b218-d38321a10242", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd13139b-bd28-49b9-8940-ac2fd116f369", "sighting_of_ref": "indicator--335c453e-8d2c-441c-be28-c9f1dd34b7fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06f8b13-1571-4032-90da-4b5d04540061", "sighting_of_ref": "indicator--f6a5f37d-f9e3-478a-9ddf-7d433d8c9f24", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e4e8dce-974c-4322-8ba8-a9b93c81c910", "sighting_of_ref": "indicator--60fde42f-cf9c-4f2a-81d9-a462a5ba6abd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e00807-1d1a-446d-854b-1df2012727a4", "sighting_of_ref": "indicator--fad7959e-46cd-4ada-a825-ea4d326938bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a12f439-69d2-473c-bb62-a394c0bbb58b", "sighting_of_ref": "indicator--302721d9-7bc2-4050-86a1-554a3dd7a21a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c5e450a-bdc4-41fc-9e08-4f2fb387a584", "sighting_of_ref": "indicator--2de2e82c-82ab-4234-b2a9-ced79aa22a6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04a5e45e-e5ce-4438-9052-47d5ec57794d", "sighting_of_ref": "indicator--b27c43bd-f761-462f-b757-2607e9c96d71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bffe1a1-8f6a-4d3a-bbb5-b7e5d58bdccb", "sighting_of_ref": "indicator--192c9540-36e4-4d90-b68c-bc5a244477fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bd61d18-f5f7-414a-9387-a81f9467cd98", "sighting_of_ref": "indicator--4e89b93c-c83d-4510-a55c-39b321f83edd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291bd2e0-7193-4dc8-8d1f-ea86f500150b", "sighting_of_ref": "indicator--6f5e7c77-e030-4d62-a4f3-d811949a278d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0901a0d6-72bd-4790-ae01-47ab9c5164e6", "sighting_of_ref": "indicator--16cde4de-e721-444b-9c53-aa910d6e6498", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--620ef5d2-531d-4269-9f4e-eacb8f5c836c", "sighting_of_ref": "indicator--54231a41-68d4-4fed-ac2a-22f2b895c2bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef77460d-f92b-4ebe-aaf5-adab4e8b1a93", "sighting_of_ref": "indicator--cc547ab3-2976-4fcf-8465-2a254abdcf8c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3327721-d08c-443c-819e-edc901cd581c", "sighting_of_ref": "indicator--3a4f1025-4fa3-4837-a76a-7184916c6d00", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3739065b-103a-4e30-8d89-36e23a1107d6", "sighting_of_ref": "indicator--d659e16e-82a8-4493-b77b-13c01dd14a0a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bdf8688-cb54-4650-afe1-b85928826d22", "sighting_of_ref": "indicator--28320ddc-06d5-4fdd-bf6e-78af53ee43ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bc19518-e284-4d87-8e51-aff18822302f", "sighting_of_ref": "indicator--99348ddb-24e4-4ec9-972b-d40b4c90cb83", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e19e7c4-e3be-4083-ab4b-99299fc64475", "sighting_of_ref": "indicator--1b42142f-9b53-4fdb-9f2a-66c01a265fbb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24e1e6e4-5c53-402d-a2f6-426e24caa6ed", "sighting_of_ref": "indicator--c78111f7-3197-48c6-8e71-5cf57eb51742", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9adf9447-8886-46ea-addb-a45ad720926d", "sighting_of_ref": "indicator--e51fcc1d-5e64-49e5-b5cd-6b1b3d6d690e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ea7189-66ba-4e99-9f4f-969abe6ea7cd", "sighting_of_ref": "indicator--51312de8-eb54-4fdc-9f44-fcbf306fd836", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a752481f-00f4-4076-88ef-089846cd52d2", "sighting_of_ref": "indicator--6b21a982-1f75-4f9b-ba0f-7e04573cd1b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c44f537-00a8-439f-b2eb-33cb6d715aea", "sighting_of_ref": "indicator--9a385be6-264f-40f7-9420-65b4fc242ff7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b749e4ec-a86e-423d-a33b-0357ee4588ef", "sighting_of_ref": "indicator--be483a87-4ba6-4064-a803-15f90709ca03", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad65cfdf-4e75-472d-88da-e5273c083633", "sighting_of_ref": "indicator--a7e728ed-85ad-4a41-8a7c-29131072b37f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c17092-d489-4fe7-9596-4cf71fff038e", "sighting_of_ref": "indicator--20a797b9-1bbf-40b5-8681-b98deac269b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5856dd78-687b-4e03-a2e3-acc57e7de8e0", "sighting_of_ref": "indicator--2956537b-6b3f-48ca-8f86-e2b652225b57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e090dc63-551b-4544-887d-5f25d046a006", "sighting_of_ref": "indicator--2af8255f-a8fb-4004-88f8-ca2eea22d64d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62a2dea2-e885-40b9-bbcb-2733b5ef1041", "sighting_of_ref": "indicator--f1e1d4a4-d794-4099-acf5-36bf362aba3c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df81b966-5fb0-41c3-a861-27b1274faaf5", "sighting_of_ref": "indicator--18ec7de5-16df-44af-9d2c-fd7a432c86e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c480212c-7a83-40b0-9575-eb20e6141a78", "sighting_of_ref": "indicator--a8f2474b-98ec-4998-8ebc-b0358c1f5d37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e58065-b2a6-463c-bfc8-c047d12727fe", "sighting_of_ref": "indicator--23a4072a-b33c-4339-ab6a-d88361bdd273", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feb60f06-3ed9-4487-a02f-4138f7973290", "sighting_of_ref": "indicator--990da301-c0f5-414a-8385-cabbb566a916", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b7d048-d6b1-4918-a358-84bb03677196", "sighting_of_ref": "indicator--3ef7a0b5-09fa-417d-a3e1-c27bcee0e43d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd11f52-2f39-40a7-aeee-31bfb64d2bbe", "sighting_of_ref": "indicator--4295ecd4-eb4d-4aa9-8efc-c47a1b658fed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a3118d0-0d03-437e-83b4-ddd89eabf75c", "sighting_of_ref": "indicator--f774feb3-d0b5-445b-be49-e8345c800609", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dbe367a-5f60-4f22-ab39-42d2b0acc9a2", "sighting_of_ref": "indicator--9209e99b-16dc-4648-84c2-dfaac463194e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7abd6718-b335-4e47-a94e-e0d4597d18a8", "sighting_of_ref": "indicator--3bd14d66-d8a6-4d9b-8f19-bd50b4544be0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c705c5b-8a81-4378-b643-233a44fbfc8d", "sighting_of_ref": "indicator--2bd8377a-e67e-41b5-b897-9dc212569882", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af852f68-3be7-4d5c-8791-9dfefca6dc2f", "sighting_of_ref": "indicator--f142c26c-b9cc-4664-9a38-039690371c0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99652cd-c395-4364-97fb-db85ab5ab05d", "sighting_of_ref": "indicator--ea89c3d2-fcba-4843-8016-c6034368473c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8717e4f2-c130-4857-be24-11dc5e338d0c", "sighting_of_ref": "indicator--1a25fd57-b847-4304-8413-23593507f553", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b706262-8af4-4933-bfdd-6148ca792126", "sighting_of_ref": "indicator--1839f1b1-7303-44bf-9c37-d18e12beccf5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--debb1bce-4a3c-418b-b5f9-ef503d3ef95a", "sighting_of_ref": "indicator--391dfc66-54ea-4c51-8321-6c2fbc713aaf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92052f60-a7bf-4156-baf1-b1deabad10c2", "sighting_of_ref": "indicator--5dd22969-9304-4022-a26e-141056834b02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06128811-2290-4105-80c3-6c280fbb1fed", "sighting_of_ref": "indicator--b586e1b2-1e46-4401-8560-d7f44e4aa915", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cad78bf-b426-45f2-afb0-7e22b110f3ed", "sighting_of_ref": "indicator--5b4cab50-ef4f-423d-a88a-f11d09fd4669", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd159d0b-52bf-470a-a2b7-b3b1811bae1e", "sighting_of_ref": "indicator--88dcb5f6-46dc-4045-a2ae-8fef306b6380", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7947a97d-4253-4679-8075-cf1868cea748", "sighting_of_ref": "indicator--8672d9f6-10b5-4149-98a6-d3dd9503198c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb568b4d-4ff6-4147-b54c-b294ea02a847", "sighting_of_ref": "indicator--462b3900-0588-4344-b0a8-34f2c53e7812", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--965c8b7c-b76b-4e4a-b481-5fa0424375d6", "sighting_of_ref": "indicator--eacaa379-45fd-45c7-aabd-22389d6db09d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4d4150-8ea3-4b40-98b6-15bdb685687d", "sighting_of_ref": "indicator--b30d517c-d593-4019-b9d1-6837e31a2ce9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaaff322-a4e3-4511-a279-3e0396d1ae57", "sighting_of_ref": "indicator--226865e4-b460-4c4e-95dc-c1978d506aca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fcf4fd7-1223-415e-8d41-601cc59687b6", "sighting_of_ref": "indicator--570946ed-9f89-4cac-a4db-dd25c011f78f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9f3c06d-41c0-4645-a8f4-2307c295b952", "sighting_of_ref": "indicator--541d0d72-a330-4037-8b8c-015be81675b1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d656e508-1967-48fe-8973-e2697cda4059", "sighting_of_ref": "indicator--d323f863-e75f-47bb-b7f4-5246c3876e22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2411c1b4-5925-4322-8b67-aa6c1762e08a", "sighting_of_ref": "indicator--22b268fa-1a63-4e3f-ba06-138ac836361e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f1feb4-05d7-460d-8d54-ee751bdc0177", "sighting_of_ref": "indicator--e53fc52a-39a7-440f-b6fc-5d27f7696ab1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3682904e-bb34-4a9a-860e-1b8333d1052f", "sighting_of_ref": "indicator--0e6a2d6a-50c6-4e52-bf46-286f3e0a4e95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--527007c0-3ecc-44af-ba35-bef35ffe14d6", "sighting_of_ref": "indicator--e1110fd6-ccb1-4dcb-927a-25d35a4f4578", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dceb8a1b-3afc-4555-a5d6-d4407740a44a", "sighting_of_ref": "indicator--1e036a4f-09af-4225-9d13-40a2cf062361", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25b09e94-5f8d-46b8-823c-157c63146dcb", "sighting_of_ref": "indicator--a165c36d-db9f-4753-9bbb-74da07b73b4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e4896c1-8844-4c1d-9221-6e2b92d54d8e", "sighting_of_ref": "indicator--458429bc-d462-4c54-8ef2-03864d05fde9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22181999-e06c-4af2-be04-e480b3c7fb36", "sighting_of_ref": "indicator--ef4a1e39-6f64-41c8-a55f-959dbc65711f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfef3c5d-ae35-41e2-abc1-1b0f622579fd", "sighting_of_ref": "indicator--1ecbc374-8886-4087-b621-c87839343f70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea62946-b967-43cb-8413-90d75c73b0c0", "sighting_of_ref": "indicator--59619ae4-5b9d-4278-a633-d9e942133220", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2f90995-5005-4b16-956c-bae38fe705c1", "sighting_of_ref": "indicator--8741a826-ee37-45ae-aa8e-984a826909f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce20fbfd-f04c-47c9-83f2-82fde09ea18f", "sighting_of_ref": "indicator--7ee5fa4b-105d-4a90-acce-affea240cba8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed34514c-1a1f-406f-ab28-cd7e07d4f62a", "sighting_of_ref": "indicator--0c6af5f2-b9f7-4e7c-bdb5-44e0f5f5d20f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fb203a-b9cb-4aaa-9795-56b344be2efc", "sighting_of_ref": "indicator--1c6ac772-8c47-4ac3-8ad8-f4103cee6ea5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13df74d1-43c6-4944-afd8-679ec9307113", "sighting_of_ref": "indicator--83a68ac7-4abd-4ba2-96fa-3b2f0376d022", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5a6d3ea-dcf5-4185-8d50-b54b23401d20", "sighting_of_ref": "indicator--4327a127-511e-47be-917a-61deb937a527", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5edbc8f-6e67-4a70-bf2c-6d2d9c0b17d2", "sighting_of_ref": "indicator--e6eebf38-49f5-4e27-ae17-3aa250db1d74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb44f5d7-3454-4d64-b26c-1a8cba0ee0c1", "sighting_of_ref": "indicator--30e67e9f-ca96-4b7e-95d5-eaa974281327", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1784cae0-9610-40c5-9146-864e7f9fcdf4", "sighting_of_ref": "indicator--a299b239-94f2-409f-9dec-2d72a4db09b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e84d04b1-2bcf-4075-957c-29fc66724711", "sighting_of_ref": "indicator--1b6f769c-0600-451f-864f-fa7a9b8f4697", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c35c2da-c1c8-4a0a-b04e-d0dd1f6efd39", "sighting_of_ref": "indicator--c0a953a2-12bf-4198-85fe-1d9b158e2fa8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6bfeb16-7257-4e5e-a011-ceccd6b7f3cb", "sighting_of_ref": "indicator--4970120f-a2d8-4608-9aa0-1a10c92b566b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c25c8a-bb68-4b33-829d-7b2f64c3c8f1", "sighting_of_ref": "indicator--aff77cef-ed82-4249-a367-ece23454b446", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2fb94e-100d-46ec-a0ee-70721cc62695", "sighting_of_ref": "indicator--4f499b2a-3302-42a1-bb81-4c9f8e614736", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abd867d5-628b-4d31-bc45-d6efca574efd", "sighting_of_ref": "indicator--9309af40-779f-4515-964c-a0567bbec840", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c39baa0-5792-40be-aac4-0e1877001860", "sighting_of_ref": "indicator--d39979d6-2891-4947-ad27-f2d4cff73a4d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec9824d7-61cc-46e4-a7aa-6789755266d6", "sighting_of_ref": "indicator--678468d4-6716-40ba-8c15-0762a09bc5f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9160ee8c-65f7-4e50-bc99-85109c737683", "sighting_of_ref": "indicator--550dce9c-1d70-4a2c-bab5-92d023440385", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--573ed5e5-65a6-49aa-9ee8-05db3b00b3e8", "sighting_of_ref": "indicator--b427f411-79be-4e07-acc9-c44672080398", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2bab977-46de-4730-af71-eea6784ce1f8", "sighting_of_ref": "indicator--45d78c5f-fea4-4263-90c1-220018695928", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ab4867-2913-4d94-9ba9-a3053e04727e", "sighting_of_ref": "indicator--87e31679-4516-4358-85e7-356831c5a5dd", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4b25815-8ee8-43e4-81b4-663ab0833ddf", "sighting_of_ref": "indicator--38d67ab7-b093-4ca7-bfb4-227a6e4f3267", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df03c743-e75e-4ac7-8f39-d33f607c7d84", "sighting_of_ref": "indicator--e8747e4f-bbc4-47f1-b961-dcf2d1e5011a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3f36bad-70b6-40d6-a393-8ca5c4e06ee2", "sighting_of_ref": "indicator--2f135e91-2d2d-46a8-9622-ed8e6c5a854d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43e296a3-91eb-483e-b7c9-e9b2f3bc83d0", "sighting_of_ref": "indicator--b3d2a189-9bbd-4af7-931f-0ddb37b7b679", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feeb9111-cc45-4ef5-9e86-6e49ebf98551", "sighting_of_ref": "indicator--e32cba93-8d74-4f24-9b7b-f2027b589f0b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71dc462b-0dd2-4ce3-9799-1c1dd7222671", "sighting_of_ref": "indicator--780823ff-466e-4739-bd42-820114eae61e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebaee150-972b-4f9e-9cd5-6554e627e920", "sighting_of_ref": "indicator--1b850d95-ae3d-4af3-919e-e43ccf5ee059", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90bd52d-30b5-42ff-bc34-0c24c58f28a5", "sighting_of_ref": "indicator--ccb5e00e-7ab2-4116-8e79-cfa99b23b2fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd3c7a82-5e97-4f1d-98ce-3769e5e1d5f3", "sighting_of_ref": "indicator--e84f51df-a9e9-41d2-9a54-41aee4c48db7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2afc65b0-724c-4a80-8046-aabaf378422c", "sighting_of_ref": "indicator--d56d3e0e-d288-483f-afd9-2c28e0215b84", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28450b6f-c562-4ccc-af75-00af6767693d", "sighting_of_ref": "indicator--fd45fa01-b314-4163-8c7e-4f38a3a66905", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7825a5e4-754f-428d-836c-2efe6ae427dd", "sighting_of_ref": "indicator--616bd33d-54ec-401e-8051-05a4b8b3f445", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a26a515c-bba9-49cf-8f48-c46155daa008", "sighting_of_ref": "indicator--68b865e4-0c95-4b61-9f01-e01dd58479ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb5e4280-d6c2-408d-be89-70a1a7f56434", "sighting_of_ref": "indicator--18cc414a-d9a8-47aa-b5dd-21b661ac1d21", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1379f638-752e-4e34-b72c-f670845f1efb", "sighting_of_ref": "indicator--48b9bb9f-2caa-426b-9da4-575673d5b044", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b094a51e-2443-465b-bce4-3dea3a80a837", "sighting_of_ref": "indicator--577fad38-dcbb-48e6-b172-4b275e2c5a93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05773ee1-9e89-4419-9bec-9e1af618580e", "sighting_of_ref": "indicator--87121209-4df3-42ce-bea5-0a562dc07f53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--007b1d24-8ef7-4e52-ac65-860b6b7d1fb9", "sighting_of_ref": "indicator--36260ec0-2cfe-4827-8d52-6a685d0b259c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39fd6bec-3776-4be3-aa23-3f1e2288283d", "sighting_of_ref": "indicator--6e78fe09-6b35-44b1-9410-779ddbb339db", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0abc5cc6-c9e6-43b7-addf-84299b7c27dc", "sighting_of_ref": "indicator--40abd406-ab32-4fbd-a8a0-dc2b838ac18f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f3b74c1-ae86-4dac-afdd-19e9ec35cb67", "sighting_of_ref": "indicator--9f577906-6871-45f2-885f-6ddf13a914e6", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0249dfc6-e82c-4d98-bd4a-1f0f38963ef3", "sighting_of_ref": "indicator--b4e6d254-c06f-473a-86e4-922cf5de47e9", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b408e40-0f73-4a41-b13f-0f75c29b3cbb", "sighting_of_ref": "indicator--b4e6d254-c06f-473a-86e4-922cf5de47e9", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bfe8bb8-1016-4cf7-a87c-f834d7f4898e", "sighting_of_ref": "indicator--e80e6d99-00f5-4010-93f3-066482a7242b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7730309-3dff-4f5a-8f36-46ec5a26fcce", "sighting_of_ref": "indicator--dd95bf75-49fc-4cfb-819d-7a6dbbdd0a33", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80eb6d8b-c3f9-4444-889a-cbbfd40f2bd0", "sighting_of_ref": "indicator--8947bd20-76dc-4776-83dc-4c54c21f33f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e403271-c5db-4ade-82ed-2d91c7213d48", "sighting_of_ref": "indicator--c5b71ba1-478f-4154-a823-c9d9557ca8a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30b5bff4-0a71-49f9-860e-94125108e172", "sighting_of_ref": "indicator--712e9c4d-b45e-4fb6-8988-cb7331a94579", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6393ee9e-b087-4dd6-a035-b1f3413b0764", "sighting_of_ref": "indicator--20dd0300-dfa3-48b4-a8f5-d9dae24de77f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70a523ae-a49b-4a0b-803a-f1f11de2b22e", "sighting_of_ref": "indicator--80fe35f3-4785-4a3f-811c-e74c2e27a125", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80d032d5-e88e-41ee-8ac7-ace5a9715cf9", "sighting_of_ref": "indicator--2f5ee8a9-ccff-462c-8206-1220c1432438", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74edc1a7-2e61-42e6-85ac-db89c9caa5af", "sighting_of_ref": "indicator--47b4620f-8378-4624-8256-351746b77672", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--881d4a48-eca1-4451-9dd9-889cca3a460b", "sighting_of_ref": "indicator--40da6a97-8e6a-4355-a763-7b5aa958406f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--713b720d-4f9b-4b01-9d32-52c8d3f12fee", "sighting_of_ref": "indicator--94eb3e37-1220-4b28-b2fa-58b2b281f57a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e71b1cd-af56-45ff-b3f1-97417b409755", "sighting_of_ref": "indicator--3ae6b640-527c-42a5-9450-b8edb1c8d476", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae6925f9-65a6-43b6-ab29-5c20e4d3d7c3", "sighting_of_ref": "indicator--52f4141c-5514-42a7-a97a-3ff9dbdd8961", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2fa9aa5-5c1e-40a1-a8d1-1d3b581eef77", "sighting_of_ref": "indicator--d062251d-5571-4aaf-bad7-24f69bbe88cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9907c32-20d3-41a4-a09c-45f79742f99b", "sighting_of_ref": "indicator--87f6bb21-144e-427b-ad48-a29eddeae343", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f70075d3-ed44-4fca-bca3-b9000c7328d7", "sighting_of_ref": "indicator--e6190452-9135-45bb-8780-62792cd14710", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f52dbbb-46b9-4bb6-87d8-c3fd7036d1ce", "sighting_of_ref": "indicator--5c777204-bbfe-48ce-9deb-c5d7b373962b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ed3f687-ed38-4b98-b8c5-a36d530db4ea", "sighting_of_ref": "indicator--f35be3f6-c672-4d6d-930e-800cef4d9827", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c69ee9f2-8dd0-409e-af0f-92cde248a764", "sighting_of_ref": "indicator--962a6cea-0ea3-4a6f-9f83-bf35c04f386e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed9a00b-60ca-4ea4-ade0-2f5d57d4fb49", "sighting_of_ref": "indicator--a20da0a3-3908-41ae-aa87-d9850aa6136f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3b0bb3e-def7-4e50-8f28-f47faa745903", "sighting_of_ref": "indicator--71c79816-20b2-4129-8271-4565f5c302ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e269675-452f-4b1b-ae77-640d0e401ac1", "sighting_of_ref": "indicator--ab53144c-2b0f-4b2b-8ba9-cfed1c2d83ad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a40bdc38-180f-4ba4-b5b9-9d736178c1dc", "sighting_of_ref": "indicator--1025c634-3492-4011-a859-a8a123057fd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ebf0034-2567-46e0-9b1f-861aa0744df9", "sighting_of_ref": "indicator--d475142b-a3ed-43d8-a016-4244910d7c12", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a739bb8-774c-4780-b2aa-01df50c167aa", "sighting_of_ref": "indicator--d5124d83-ed0b-4072-b934-921ff57f1afa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6feaa458-3ec9-44db-b336-b3e6029d38c4", "sighting_of_ref": "indicator--332dec8f-c54b-4df8-ac7e-af4f03e2d077", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f76fa7-f737-4cc7-bcf4-c6f44921989f", "sighting_of_ref": "indicator--8c3e8604-1bcc-4e2e-85b1-41864282067e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d9d6f2c-dbc7-45ce-936e-34c9f7480dc8", "sighting_of_ref": "indicator--fb9a59e2-6266-432e-9429-e3d824297e4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2828382-df36-4c2c-8a5d-6d8bb9401344", "sighting_of_ref": "indicator--6e2390be-5f8d-4791-a2bb-4806d0c6babd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85f56fa8-2daa-449c-be8a-c6194c814b7f", "sighting_of_ref": "indicator--ec86c81a-1a45-41f0-b17d-7db608b144ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c801f2-70be-4456-bbd7-8757f4270032", "sighting_of_ref": "indicator--720f5886-a199-40ff-9142-5bc293481e20", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--924d4a60-0336-4098-b5b5-8ce684ce1f90", "sighting_of_ref": "indicator--fd669c6b-b27c-4d12-b5b3-388de28c30cb", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57d6d330-8087-4d7e-a5d1-0bda284bc66b", "sighting_of_ref": "indicator--f559ca1e-6d38-4e4c-b5d1-f8f6bf44ce7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffa16d69-b7be-4e62-9800-ac49ba41be0a", "sighting_of_ref": "indicator--4d95f628-c051-4f23-a0b2-c997bad0df0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed451c1-27eb-44c1-9598-ee04d1af48c5", "sighting_of_ref": "indicator--21de6bb9-a249-4137-b858-226184d886f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199dd01a-7415-4763-8548-79ac9b224ae9", "sighting_of_ref": "indicator--b836fc67-e9c0-428a-b6c1-7136b6dbc222", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5103576-eba1-4d38-b8fb-3a6da07bdef7", "sighting_of_ref": "indicator--b7700189-73b7-486f-bda8-0f82a7d6c7c5", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f6b623a-4ae0-4f4b-ade1-f16341d2c7be", "sighting_of_ref": "indicator--b7700189-73b7-486f-bda8-0f82a7d6c7c5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18e64920-2cec-4ba1-8218-8d2903e3f5ac", "sighting_of_ref": "indicator--514a6e9b-2898-4e23-87f9-4adcc6e9b474", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07df7277-3b35-4823-83b1-248f198fc669", "sighting_of_ref": "indicator--4d7c57be-cc4c-4596-9449-391da78d7393", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dd34f56-fcfb-49d8-8070-b800b80644d8", "sighting_of_ref": "indicator--812d93b8-c322-4891-a1bf-206d425f75b5", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809a5a88-38af-490d-bc7e-933f911e46d8", "sighting_of_ref": "indicator--5edd165c-94fb-4526-b31a-8c8af8648196", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1efcb11a-9d1b-4bac-a7d4-a6bcaa930838", "sighting_of_ref": "indicator--af2f81bb-3812-4cf6-ab3a-20aab6fc3202", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15fc588-6a80-471f-b453-dbe51be73c07", "sighting_of_ref": "indicator--5fb9da47-9db6-405f-86a4-bbe0af426c5c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913a3389-7463-4691-9a13-9089fdfa9693", "sighting_of_ref": "indicator--5f97c3e5-a6f4-4567-8e7c-61516552ab07", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79afc1f8-3089-4831-a6ac-b4da355e0f8e", "sighting_of_ref": "indicator--02412edc-3417-4c41-a52c-032563847a9b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab8b5687-c2fa-4d8a-a1a7-adc3fb3dfe01", "sighting_of_ref": "indicator--46fd26f8-6682-4a04-977f-f90b9d9767af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1f4c5b-2bc0-4587-b2a2-c559f828ec5a", "sighting_of_ref": "indicator--5a41283d-b98f-4f86-b497-9aac10ab2e76", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae3bffb-0d95-4b4f-843a-cc3a515dbc34", "sighting_of_ref": "indicator--3d54fa54-3336-49c0-9253-fc297b83668b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--990e0a52-b96c-4d93-ae11-6a676a8e05cd", "sighting_of_ref": "indicator--55d8aaad-23ba-4688-95a1-c56a9866aacb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64e2f580-8188-4cab-bea7-d9c8a3fd06c2", "sighting_of_ref": "indicator--43b2ae07-c5bf-41de-9fb4-1bcb80827269", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bbcb450-ab36-4b1b-8de3-b747c2004231", "sighting_of_ref": "indicator--a72c78b1-69f8-42b7-87a8-12587bd6de83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aefcfd9d-6cb0-415d-9d1f-7739601db41b", "sighting_of_ref": "indicator--9fb7d65c-4f5e-452f-95d6-71323c9917fd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6840bcb2-5dfb-4afa-97f1-c40733ac1c71", "sighting_of_ref": "indicator--0315371a-0c8c-458a-a6c1-984c51beb614", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d4e7b77-06da-4cbd-b97b-905e8766cfc7", "sighting_of_ref": "indicator--bbebc017-9ff5-4835-818d-715d6b1241b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1208945b-ba80-475c-8f43-7c3d5d81589f", "sighting_of_ref": "indicator--888eb304-87d3-41d3-8183-5fddc9e5b79a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92a2e621-7d81-4579-b513-0a86c41619e4", "sighting_of_ref": "indicator--e58974ee-98a8-44d4-8373-963eedecdd53", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8402c4f-c94b-4ab4-b18b-e8d95fbb28fd", "sighting_of_ref": "indicator--3e7999bc-5183-4707-962e-54a1cad8d656", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1304e5a9-4f96-42bf-af5a-2f393abe15a6", "sighting_of_ref": "indicator--9d807f84-6ed4-418b-98f1-9e1f1d868676", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10e9b05c-ecb8-4bda-9014-56fa6b8c2cf2", "sighting_of_ref": "indicator--de8deade-2e33-4df4-b008-702770c3a4f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--549ef937-91b3-4784-9a6f-114e93ec59cd", "sighting_of_ref": "indicator--975a12af-21c3-4de7-8a6a-5c0e97289b8c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--659a6242-5153-4509-a926-5f895a759f2d", "sighting_of_ref": "indicator--a7f9f150-f13a-4776-9686-c9c2cb5d321e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2eeb8f6-a844-437b-a702-1bd1be06115a", "sighting_of_ref": "indicator--9d23d846-3696-43b0-970b-b21c5c8fc491", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--294cd246-133c-485b-a9ee-a4bdb6fd1ba9", "sighting_of_ref": "indicator--6d3e0881-763e-4b55-be0b-43825faf9b33", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75330ccc-de8a-4e4b-9972-9f10445ec864", "sighting_of_ref": "indicator--a58f5d7a-e6a6-4ecd-bbdd-e8c36e3f793c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f66bda4-218e-425e-a408-19ceae8c8e40", "sighting_of_ref": "indicator--0ae6b827-7a8a-4936-b3b2-99deea7e4d4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0e973a7-20ba-41fd-8a44-899fb0edfbc6", "sighting_of_ref": "indicator--f45f5830-35b0-4dec-882f-8932ee4e0501", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35c22bc-a887-4266-8765-adc796123271", "sighting_of_ref": "indicator--93e81d99-1e74-49a9-a756-5f063c534756", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--677ccc88-e581-4950-8b9b-f3aebe56da7e", "sighting_of_ref": "indicator--d953b272-2c1d-43f0-b0f3-31d413158e39", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0546156-280a-4f75-9b52-f04ef0c0e225", "sighting_of_ref": "indicator--d953b272-2c1d-43f0-b0f3-31d413158e39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e662c4c-09a9-46c0-98c5-9d8e28dd0ebb", "sighting_of_ref": "indicator--d33d16b6-0a5a-45ef-8d5b-8ba47f1b9516", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131d7a3a-a2e0-49e5-9e2b-a4e6349221d3", "sighting_of_ref": "indicator--7a71f5f4-e80d-4158-846a-5cebe5917fc0", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b480b5-747b-4f26-a6a5-b858872037d8", "sighting_of_ref": "indicator--e2c846c4-e5ae-434d-885f-32857fbfc5ef", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca55f982-d0c9-4c71-b5e2-f3ebc3a01529", "sighting_of_ref": "indicator--8a2f4001-7d18-481d-9867-c22043eb7069", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6295710a-3c30-4a05-8f9e-2cb7df334c23", "sighting_of_ref": "indicator--765f560f-9a98-47dd-addd-79c087e66a03", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91ff25a-2fd5-4e96-9666-b03830bce6cd", "sighting_of_ref": "indicator--b62c5029-a017-42e3-96b8-da88a94a155e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae68796-c9ff-47af-9d2d-7ef47585e71a", "sighting_of_ref": "indicator--3a992df4-0362-43a7-afa0-a0b361467ccf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--645d88d9-184a-418d-b26b-f7e18ba924cb", "sighting_of_ref": "indicator--3ea535b8-d610-4172-81af-3ae54f3bfba1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee5edd9a-b49d-404d-b30d-40473050cfbc", "sighting_of_ref": "indicator--3ea535b8-d610-4172-81af-3ae54f3bfba1", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f23360-911a-4dc2-bbd8-f5d723faa9db", "sighting_of_ref": "indicator--7658b8d5-a8a3-4a1e-97b2-58fcf5c7adeb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a908e3-1d22-4f51-b650-ec0570783d1d", "sighting_of_ref": "indicator--633faee8-1c3f-4e2f-a842-d1623a296867", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5fca918-e03c-4070-906b-757db186357f", "sighting_of_ref": "indicator--635813f0-7f8a-4e34-a661-84016c78f1f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05d28ce5-25c2-428d-8cb8-5e47a5726481", "sighting_of_ref": "indicator--abb1d41a-89ad-45b9-88f7-2e714cbcd9e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--896454da-a500-4282-8923-bd5e75a722fb", "sighting_of_ref": "indicator--ec03b0da-5ae8-4f70-b5ea-f08d96ad08b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aab1ca3a-49ce-4a1c-ba08-ecdb02699a18", "sighting_of_ref": "indicator--ffb3da8a-f477-4103-a0b4-256a55a2efa3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66877914-4f53-4b46-93fc-67c9b4a430c1", "sighting_of_ref": "indicator--9d91a986-9488-4aad-920f-4530450c408a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff050c1e-935b-40a3-a9fe-c8d1c2d8230c", "sighting_of_ref": "indicator--fb7fb52e-6be9-4fc5-8d4e-6ee7d747fca6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cf7b68c-3320-47ae-ba72-d1bff88a9bca", "sighting_of_ref": "indicator--d71079bf-c709-4dea-bdde-c796a73fe45c", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fc9238b-3f2b-423d-9286-be19084f6c81", "sighting_of_ref": "indicator--4ee7ba88-727e-4381-9852-6cc7795f3f47", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44d1522b-162c-4029-96ee-ad3830ab98c2", "sighting_of_ref": "indicator--dd237cae-783e-41c0-885b-3677044df7e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--914eb25a-e590-42a9-86ca-344b2daaa0b5", "sighting_of_ref": "indicator--19665f6b-b413-47b5-87f8-57ba36a11531", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ecac5f9-dd3d-434a-aecb-84fafb6ab322", "sighting_of_ref": "indicator--f77367fa-e3c7-4d77-9832-352befd53d4e", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a803d0-f6f2-4b48-9218-af88ef26e1e9", "sighting_of_ref": "indicator--7ad75d2d-a1f9-42d4-b20f-8dc240ee6d96", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--babffef2-32f8-4958-8bf1-422f3ade8c5b", "sighting_of_ref": "indicator--6cf84c9b-1420-4874-b8a8-7dbf23ae2800", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35f1faa-063e-4d23-b16b-8dc66bb8c39d", "sighting_of_ref": "indicator--bd857fc6-aed2-4ce2-aa78-263058719520", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--236e7209-2726-49d2-9546-6d236d0e8904", "sighting_of_ref": "indicator--2cb73e9b-b59d-4054-8f35-c84db7eac488", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff97963-31ca-4e73-a6eb-0af760ce88d5", "sighting_of_ref": "indicator--bfd53810-56f1-4fab-a005-6d6719ef36cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77fdecd0-17c2-4961-8b54-ab0fe45913cc", "sighting_of_ref": "indicator--c78d622a-74fd-4b07-89ed-bd58a988088e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03dabf2f-9968-4753-b8be-3b293af81920", "sighting_of_ref": "indicator--cc167fd2-4cb2-4826-88c9-603d97a99fab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8dd9866-cdaf-487f-b789-4993043235c7", "sighting_of_ref": "indicator--4e554f0c-54a0-443b-8147-b5bf9cca248d", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e0a422-f2e2-4c6d-9c28-a7b248d0a0c1", "sighting_of_ref": "indicator--9e05141a-96f6-4f7a-80a7-5e979f63e3c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfc792fc-d998-4562-aca1-301f7c8ee74f", "sighting_of_ref": "indicator--29036108-7398-4948-8b94-11872effca6c", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534fa3dc-b298-4a39-be2e-4804e6de50ce", "sighting_of_ref": "indicator--c9c5f868-a729-4645-a542-ec842cfed16b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3173f2bd-21cd-4822-b52f-53d6bb054091", "sighting_of_ref": "indicator--233d4bd2-71cc-4132-9be0-47e2bd4df2e8", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd807fe-9da2-41c6-8e55-41e24a2f43fa", "sighting_of_ref": "indicator--233d4bd2-71cc-4132-9be0-47e2bd4df2e8", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89692389-a2c8-4602-8cee-a4018a6065db", "sighting_of_ref": "indicator--89936b46-7834-4566-9df7-a9d4c695db78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eda3ebd-553d-4a85-8a6a-a4bdc45751f8", "sighting_of_ref": "indicator--10046ec2-556d-4f12-b856-63b039924002", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--264b8ee4-de30-4b45-9d08-1dc3f8bb06fa", "sighting_of_ref": "indicator--b198e0e9-1733-4032-a8ad-d9ba1cec68f2", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d0917f-d251-431d-a589-166e7f95e9e6", "sighting_of_ref": "indicator--7e0f58dc-dc72-47a7-ac73-4922672dd722", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84604a0b-ad0e-4031-9174-2949cb836708", "sighting_of_ref": "indicator--caddef24-1447-4a3b-90df-a182f0f67734", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c13e0af-2a0f-475b-b4da-cc79731abf62", "sighting_of_ref": "indicator--b5281f1e-2d30-4644-b9ee-55d0f62df58f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d11b23d-614d-46f7-ba23-ca061115bcb4", "sighting_of_ref": "indicator--24447245-b15e-419b-a08a-c81070f1f2b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ddb397b-4f8f-4b15-a55a-4634ff6e1ff3", "sighting_of_ref": "indicator--23820242-aedf-40b6-ab8e-a6a46d789273", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2920823a-caf8-4965-a297-f02a22438c3e", "sighting_of_ref": "indicator--5a9ecc82-0f2a-4ad8-b243-0681d1e3cf53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5533eab7-1265-4f3c-9812-68b05a949499", "sighting_of_ref": "indicator--4ddc0241-9db3-4dc1-9031-dacf3ff76096", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b290fa8e-8f21-4dbf-97e2-8c1a64728484", "sighting_of_ref": "indicator--7c2702b8-cf67-4346-b520-05c20f24734b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2270ef-7269-4353-9bfd-6fd173cbd114", "sighting_of_ref": "indicator--d5efb891-ca37-438d-be19-d10da51483f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--185b5f01-c55c-4166-bd17-0f4b4855a9ec", "sighting_of_ref": "indicator--16ff061c-4b72-401d-8d0c-28f636fe9c8c", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--607dc4a9-f8b0-41c8-80d2-27b7073f4631", "sighting_of_ref": "indicator--34c98b74-f96b-4f1c-9aa8-e3fa5a17f2e9", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54c73a60-d269-4c8d-8e0c-f1a7d3abe3d6", "sighting_of_ref": "indicator--2dec25c8-e918-4ec5-aca5-295586bc8803", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66f9cc3-8331-4061-9c39-5b3df783519e", "sighting_of_ref": "indicator--fb485908-d878-4d62-a80c-096448f8c295", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb19dd61-f61b-4045-a3f9-86774119f2c2", "sighting_of_ref": "indicator--83b74a39-906c-4130-a000-1b6d63a1b389", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9478b1-55b2-4e17-b0ec-328a2644df27", "sighting_of_ref": "indicator--ea35d243-28c4-4951-a84e-bc96520d2ba4", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1ecee7-a732-4121-ab76-3392d69535df", "sighting_of_ref": "indicator--85cfd651-3a5f-4d95-86e6-dda483fad9cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--890b07ba-0219-48dd-9992-72e2df192989", "sighting_of_ref": "indicator--8261ee07-64f5-488b-94ff-bc0fac64e4e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deceaf99-46bb-4e73-adf4-ce7a11e844f9", "sighting_of_ref": "indicator--9699158b-7327-4cf1-9c34-8520a045c576", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--494d8204-5c21-4af5-abb6-d62806473e96", "sighting_of_ref": "indicator--2f19dee0-4552-4cb2-815c-fc708ff7b536", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d9a44a4-c685-4383-9637-f97f223777f9", "sighting_of_ref": "indicator--d71d7d10-03e2-482d-9c89-971511b16086", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c042280-eaae-4400-9449-62e047e83b1c", "sighting_of_ref": "indicator--6c25d9c8-68a1-43a2-882f-b374a7609c05", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395748e4-bdaf-4e10-9d41-f0c9a7d0eb62", "sighting_of_ref": "indicator--d65efaf1-0e82-4061-b137-d5517a6e36e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c24c6b-8599-4ae1-93a3-085c9f733292", "sighting_of_ref": "indicator--8e64fe52-ea67-40b9-bc15-aa48a127019f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--508fb851-6835-48de-ab69-26f80084e29c", "sighting_of_ref": "indicator--25e65bdd-9385-4aa1-b2e4-aed584fbe9ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e586c8-738d-4e76-8967-b31e73d23b61", "sighting_of_ref": "indicator--dd5ad79a-2a91-4e61-9dc9-1a4d7dafb953", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc64628a-851c-4b0e-8c1e-d1d028b43f76", "sighting_of_ref": "indicator--db04415c-a053-41b3-bd63-a26e39ecff7a", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49fb95fd-4c44-4d57-9f64-f2d642da18b4", "sighting_of_ref": "indicator--de622ed4-a9af-4f76-a425-e23fb5ffff84", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d778b1ef-4910-4a29-a1dd-fbc25557f374", "sighting_of_ref": "indicator--d0851475-d087-4056-8fcb-281932715494", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55fafc8c-e84e-46de-ba8d-bbbd686b25e7", "sighting_of_ref": "indicator--ac23d9e4-d39b-45bb-909b-3ab7e86e63fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e50f6ab-ad1f-40e2-8ee2-3fa4365bf171", "sighting_of_ref": "indicator--37aa0fa9-c9ff-4f7d-81ec-dbd46c555284", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f587058-764d-45a5-bfcd-f9167d57f8ac", "sighting_of_ref": "indicator--495e6ca9-932c-4c31-8b5b-64dc869b9ff1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a41fda0-024a-4c13-98cf-8fc4f9b7c9cf", "sighting_of_ref": "indicator--c915e47b-22bf-4827-a564-2b9ebeca07fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fb38fdd-0cc1-4e78-b8ed-07b4889b76aa", "sighting_of_ref": "indicator--5426d379-9918-4099-9f3a-a6717abd31ec", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f636e37-05b9-4301-ae3f-88cddbb43289", "sighting_of_ref": "indicator--e304616f-b3b7-4dbb-bfa3-0cd173c472f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--224a6497-e449-45f0-a8bf-dd9b5ede1185", "sighting_of_ref": "indicator--7f22b1f0-b4b5-4214-a9d9-c9b987ce7374", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5209fd4-46db-4061-957e-078f10c2001f", "sighting_of_ref": "indicator--9474afc0-6eb1-461f-a671-b36db47af4f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a2b1ef-6c51-477c-889b-aefaa4e10716", "sighting_of_ref": "indicator--258344c7-1b56-4a7d-b9ec-90cc406cb861", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5e27125-1f42-4a28-bdad-f7ff63e09df0", "sighting_of_ref": "indicator--9b4ddc65-4509-4244-94b7-f8dd73f56f7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e3bf353-b702-4ee2-90bd-347ef5574969", "sighting_of_ref": "indicator--d7df9e4e-efe9-45ac-98c4-3f25873d53bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--268ed83f-495c-41d2-9672-d538ad575e77", "sighting_of_ref": "indicator--2388a590-0983-4cf6-8032-53a5269c2de0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a5d075-8157-4ad3-8936-668d1b05b4a7", "sighting_of_ref": "indicator--064c53c6-dc63-4203-a047-d83020937a53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76f6dfb-1916-4fa5-b2a0-abe042e5d445", "sighting_of_ref": "indicator--7199f66a-1dfc-4350-8916-57bbdd52636f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f45370cf-948c-4e63-bbcf-6cc876ee5ec0", "sighting_of_ref": "indicator--8d101581-9bce-4019-ba29-ef51979b4604", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27fe0b0b-4470-4d3c-9433-a8cb67f9ce81", "sighting_of_ref": "indicator--c3ea3965-6e4f-43c8-bd2a-84502107b20e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c50269-6828-40c3-85c1-bfbe6047f869", "sighting_of_ref": "indicator--3565f9f0-ca7a-4b68-9ed5-eb2a3b6a494e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dad559a8-5005-489d-990b-f3edcf7f43e3", "sighting_of_ref": "indicator--974ca006-fdb2-4c3f-90e3-f97ce1cdc470", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516b08c7-eb3a-496e-8551-5c6ad4bfd311", "sighting_of_ref": "indicator--65caa80f-50d5-4607-bb9f-d7e7d69f3c99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538d91cb-5d98-476f-a0a2-eb926d34f2b1", "sighting_of_ref": "indicator--8d2571f3-0c93-4c11-8fdd-a8dbbe67607c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa76d829-5001-4f56-856c-4a773b573713", "sighting_of_ref": "indicator--6204a4de-83f4-454f-a015-441cad215e8d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e5ccfe8-ac89-4699-8004-6aea1868c96f", "sighting_of_ref": "indicator--2b181f0c-4722-486f-94f9-f0e53e401b38", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8bd1f3e-42f8-4a53-810d-ab1e77dabf5f", "sighting_of_ref": "indicator--90514f64-627e-406e-b8ea-1c5517f6ec92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7702756d-6e79-45be-805b-5e3107f8dc1d", "sighting_of_ref": "indicator--9b28fbdb-3408-4418-9a73-ec29863bd4a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--addcac70-e128-4f21-9bf7-31f42784fe5b", "sighting_of_ref": "indicator--f588de98-7d65-49c0-bd3b-7248bd84eeef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--599f7c85-e51a-41ab-bdb2-bbb8de5daab3", "sighting_of_ref": "indicator--73c4a877-7498-4595-a1de-ed816b39f1fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de0400d4-b0fb-4eed-a0d9-39744c3a6403", "sighting_of_ref": "indicator--ddea3f4e-fbba-4ef1-8f91-6a2dd64dc84f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9ed981-2039-4a9d-830e-b7098a87ea56", "sighting_of_ref": "indicator--76e16dea-a7bd-435e-8981-f8116fe479fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55b16814-88b5-4e78-bc55-01a57bb41243", "sighting_of_ref": "indicator--2220138c-f9eb-45ba-85ca-965336070109", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fce51272-72d8-43c3-a7cc-1143187a559b", "sighting_of_ref": "indicator--6d7ea662-c56b-41df-a715-6e77820ed32b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76101e06-d953-4044-aaa4-a774c566f90e", "sighting_of_ref": "indicator--82227096-2340-4a7a-aeac-812b7038e786", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754f6585-8130-4070-bd5e-4f65dad490f4", "sighting_of_ref": "indicator--de3f0c00-b61f-46ca-b3c2-a11fce6d4c46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0207c7a8-a9a1-4630-9709-52db3d6a4c36", "sighting_of_ref": "indicator--6ecaf4ad-ecf7-4fbe-9950-68ca2bc9f9f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7906aeb-d4fb-4e13-9f27-b611206f3c21", "sighting_of_ref": "indicator--6ce504f9-25d7-41da-b8f6-30d44e5fbbfe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4425c2d1-f07d-48ce-b511-ecae02a57e8a", "sighting_of_ref": "indicator--9b399478-6534-4349-8fad-8f3fffa34c6b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a21b05b8-b194-490a-8e25-721a94d2f672", "sighting_of_ref": "indicator--ffaa9164-7291-4ce7-a676-c596b9187b42", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b7a901-2ef3-4cea-9540-b7d4ff0f4722", "sighting_of_ref": "indicator--fec39e5b-190f-4541-9528-b7ffeb56a2f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45402323-2d13-4f9d-a496-5e124c2cb8b8", "sighting_of_ref": "indicator--0ced610d-8a5c-46fd-b335-61f68b7519ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5618e6c2-0df3-4ed9-814c-48c5b3ce942b", "sighting_of_ref": "indicator--261aeb3c-21d6-45d8-b263-2829735271c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ba24e8e-22f0-43f9-b6b6-227272fa5d5d", "sighting_of_ref": "indicator--bce7addc-2f60-4eb7-87bc-6b70d67e14ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb0bfbd-3145-4c20-846e-35bb2ce412d3", "sighting_of_ref": "indicator--d23115c9-f510-42d8-b8d9-39a17328db2f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a960001-24b4-4545-8008-2145792039e7", "sighting_of_ref": "indicator--e6289f90-b438-485c-a5ca-d876ed7d2a6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e52a7592-0699-4d78-8bbf-fb4bba254552", "sighting_of_ref": "indicator--639bbbb7-39ec-4f76-a9cb-e0d8dec5812f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4bf6a99-1686-4857-b36e-0c91895ab7e1", "sighting_of_ref": "indicator--8951f7ff-850d-429f-9d0b-001a386fa63a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b736727e-3613-4afe-9d5d-231fd6b3ab14", "sighting_of_ref": "indicator--b89e2aca-cc3a-4b13-9bee-fd8608bab310", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e40ed538-e6df-4a02-be8b-d1193d7fec4f", "sighting_of_ref": "indicator--3b7eaba6-8b7f-47f8-aac8-86c34be248a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dd9b226-7dc2-4a6b-a0b9-30864f7d0659", "sighting_of_ref": "indicator--d0f172ed-a5d0-47ee-b131-4169e705bc85", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f07e2c5-3d96-408a-acdd-f0890f88b4b4", "sighting_of_ref": "indicator--c5dc2caa-8389-4eb5-9be9-ec63f13bfd94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--656f5942-5dbe-4670-92bc-c79dd19fe741", "sighting_of_ref": "indicator--5aa7204f-1357-4993-843c-b4e0034e2b50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6821fe20-cd20-43fe-b6b1-02f10e2dd066", "sighting_of_ref": "indicator--06bcb1d6-4bc6-4351-bdd2-156863fc59ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9587a8eb-175d-4404-b0a3-bb53fffd40d7", "sighting_of_ref": "indicator--25c4d662-7e07-4f95-95a5-ef161ef81b5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebd5142c-ddae-4b2d-bea9-fef0d5dcb0bb", "sighting_of_ref": "indicator--683bf9f3-a5b9-4bf1-8ada-c6383e86bda9", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c225763-fe20-4396-a5d9-35d6477000fd", "sighting_of_ref": "indicator--26884f3d-19cc-4180-b835-0e1b539a9662", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f120e189-4a45-40e6-8052-263afd6f83ab", "sighting_of_ref": "indicator--90fac826-1994-40d6-85d5-a7a33e964f97", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee7ec990-3a1c-4112-8a6a-c40dbfbb01d1", "sighting_of_ref": "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e1ee1d-b7dc-4434-bb4e-e3a22e96a54e", "sighting_of_ref": "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e418b7e-cf3f-4f2e-a4d7-f6ce2a09e480", "sighting_of_ref": "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--984d4be2-502f-4d5f-86a3-cd52e33f34d0", "sighting_of_ref": "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e7ea8da-dd1c-484c-afdd-cf121287a8c5", "sighting_of_ref": "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74a139b5-f50a-46e1-a303-c88de0fe6786", "sighting_of_ref": "indicator--27045105-3f54-49a1-b893-4dffcb82c5f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb425f1-d025-4bf1-a0ee-4ebb1958e4e7", "sighting_of_ref": "indicator--27045105-3f54-49a1-b893-4dffcb82c5f8", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--261f0ea0-e256-41ca-9712-263db35f63b8", "sighting_of_ref": "indicator--27045105-3f54-49a1-b893-4dffcb82c5f8", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc4af05-a05c-4130-a4f7-782de0e2eb51", "sighting_of_ref": "indicator--534cd640-0154-4d06-8fd4-c2364db5a9e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecc5b842-8855-476a-8640-856bcfdfa289", "sighting_of_ref": "indicator--534cd640-0154-4d06-8fd4-c2364db5a9e6", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac12ad1-2b72-4f51-b5fe-4b64780e3511", "sighting_of_ref": "indicator--534cd640-0154-4d06-8fd4-c2364db5a9e6", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd4e569a-618a-48ae-b32c-62aa99a96322", "sighting_of_ref": "indicator--e5e094d1-56a6-49b6-84bb-456dfdfc3ecb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ccfae44-bc3b-4227-966b-fe18a8b84f5b", "sighting_of_ref": "indicator--e5e094d1-56a6-49b6-84bb-456dfdfc3ecb", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d7dfb57-7c5a-4929-85fb-0c7ab2e31780", "sighting_of_ref": "indicator--e5e094d1-56a6-49b6-84bb-456dfdfc3ecb", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0682461c-8567-4f83-af0b-41312ba595e7", "sighting_of_ref": "indicator--07e8b819-ff9e-4bd1-be1d-b4af60792fcb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb399b2-70d9-4e0f-b8b6-79f04965dcfd", "sighting_of_ref": "indicator--07e8b819-ff9e-4bd1-be1d-b4af60792fcb", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e53f12-b986-47e6-aa81-cfb2a147926d", "sighting_of_ref": "indicator--07e8b819-ff9e-4bd1-be1d-b4af60792fcb", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b6a806-34c8-4a36-b3c1-da42ecc7225c", "sighting_of_ref": "indicator--d33a1c8b-2ff6-480f-8b0e-f8272c52a4f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--233da58b-89d1-4f2d-b7b8-dba2d3dac800", "sighting_of_ref": "indicator--d33a1c8b-2ff6-480f-8b0e-f8272c52a4f5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c70d45-4743-4598-9d47-096835446800", "sighting_of_ref": "indicator--d33a1c8b-2ff6-480f-8b0e-f8272c52a4f5", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d63fdf1-dc6a-43b5-a9d2-e56ee5bc13a1", "sighting_of_ref": "indicator--193fe15b-ecc9-4b9a-908b-4d765d8e0898", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20264f24-54b2-4638-9cf0-fdb4ba5b2447", "sighting_of_ref": "indicator--25c606e9-a424-45e2-8db1-1247c7c22169", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9cf28e7-e8bc-4256-8f0f-5a917731a477", "sighting_of_ref": "indicator--afb73f5d-ce50-4c54-9f5a-44a2374b7529", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc8173d1-2e82-4bb4-aae5-f7c9929236ca", "sighting_of_ref": "indicator--3c883710-6a34-4f78-9343-8bfcc5d8576a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f64ffd87-3adf-4a92-aae1-85e3bb85613d", "sighting_of_ref": "indicator--97f1c1e0-bda0-4ce2-9cc8-397664c34e80", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2edb5fd9-1fba-4fa7-aa3e-4438688768a2", "sighting_of_ref": "indicator--7866df98-49e3-49a7-ad28-13b946b12e6b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c36e9693-4c91-47b4-938a-c0c62d053b8c", "sighting_of_ref": "indicator--c2e37de1-4df0-4ec4-8e5f-4dc15e9d455f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bcc2948-1d4c-4436-967e-07795901c722", "sighting_of_ref": "indicator--959c5397-241b-4963-82fe-23a7ca05f5bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d4027af-39fd-46d1-b732-bd2a0a75b38b", "sighting_of_ref": "indicator--ccf59c3d-3d8c-4885-971c-2930ac891dc3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38aca04c-3819-4393-8624-eea5afc05b51", "sighting_of_ref": "indicator--356a6851-6d6d-4024-a1f6-afad4284aeac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45b07a77-ac57-449c-94dd-6498b0f20741", "sighting_of_ref": "indicator--55ac3767-71df-4aaf-9339-2dc058523d8b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffed4d00-15f6-43de-a028-3a3a3cf3bb25", "sighting_of_ref": "indicator--1b958522-4cc1-47ee-abe1-0877bbfb9ac6", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52f21c7f-c665-43f3-8fab-65f456bd1206", "sighting_of_ref": "indicator--1fc41ea8-77b2-4b72-bf75-cf174249eaf3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f5e05fc-298b-431a-a8e3-9490ec6d331e", "sighting_of_ref": "indicator--b879fde0-087a-4a64-9c13-7c1f48bb5c70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2de17ce-8dc3-4b5c-8b98-5fa6ffdd8cb8", "sighting_of_ref": "indicator--5b638a62-22d7-4a61-9213-a968e42e979a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d521f87-e21a-4467-b7a0-a21fa4e2307c", "sighting_of_ref": "indicator--48c41872-6c1b-4dce-9378-56b32bea4a79", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc13b440-373c-4867-b1e3-81e44a687833", "sighting_of_ref": "indicator--46f6730a-f00c-4537-b6a0-1be23391b3d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd23296b-b2b8-4a94-b727-b7aa56ff14af", "sighting_of_ref": "indicator--446fa394-85db-4555-9f48-93a374e6f75f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--506f5caa-f4cd-415c-ba47-14e071f3d3c5", "sighting_of_ref": "indicator--943b6031-854a-4068-9de0-d13db08a4484", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fe27e4d-907e-4f98-a79a-337aa7e1bd9b", "sighting_of_ref": "indicator--e21b7f67-721c-417d-b4e6-efa0bac7e54d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8a0c51f-462e-4a3d-9aee-96160a0c8c5c", "sighting_of_ref": "indicator--ea583bf2-b00e-4e5b-92bf-18c8a06c7946", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6321c85-660e-46db-8be4-76ccb6408fe5", "sighting_of_ref": "indicator--e49c0046-c4dc-4c92-80e5-ba9475de4eeb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a28081-da16-4059-99aa-f56a3d41f00a", "sighting_of_ref": "indicator--68726f79-686f-4a01-9c0d-6e7f85ad3824", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--370df6c7-afad-4825-ba30-4c523d7ee641", "sighting_of_ref": "indicator--be4383d2-c560-4d05-a136-9693dd41b5e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d660e0a8-5001-447d-b275-ce2620d9680c", "sighting_of_ref": "indicator--e3004fe3-db73-43f3-978f-025b03c20146", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f90d96-020c-4f8b-bf2b-0a93f3600a35", "sighting_of_ref": "indicator--386a7851-823b-4292-901e-12a8f3095b74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c130addc-3207-4dfb-bad6-a4ec5a4ec9a9", "sighting_of_ref": "indicator--e5061127-dcb3-4a39-9ca1-5a0df325e2ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14c53c7-2ce6-4989-af92-db32ede3eee6", "sighting_of_ref": "indicator--285f6340-3752-4e97-83cd-815b9b312749", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81e525c7-9aac-4127-8bd9-4d6746b35eb1", "sighting_of_ref": "indicator--b6a72ecf-a66f-45fd-8a47-0bd69b5ccb3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b963a9b-9dce-4c53-a046-1a56f6b014c6", "sighting_of_ref": "indicator--2b5cb2f4-8e34-4284-9eae-b7d785375808", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6833890a-2e27-465e-ab9a-cae730f76c25", "sighting_of_ref": "indicator--4cd2d0fb-c317-4776-a078-a039ffcc5324", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8080f336-76c1-4654-9b23-153252fe7ca9", "sighting_of_ref": "indicator--a48c5540-4f25-48de-9d23-0a8fc8f935a6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33669426-da53-42e1-badd-2fc7a4852502", "sighting_of_ref": "indicator--56d838fb-b9b5-4c4a-8903-64f5ec9a0cf8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf23634f-eb1c-49da-bce1-8f5225e2c465", "sighting_of_ref": "indicator--b984fef0-0448-4e95-b40a-8b91e9fdd5e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26a9778f-f6a0-4bdd-a730-49d8aab98d2c", "sighting_of_ref": "indicator--69743aa7-5740-481d-8836-df49a99c3530", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c128a77b-cbb4-4ffd-98af-7d63850a4f93", "sighting_of_ref": "indicator--c4d4bf4a-9158-4ce8-8222-70f23118bb53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5e394e-04cb-47f2-8e0d-4ab8dfe818c7", "sighting_of_ref": "indicator--16352f6c-4105-4936-990f-a91f7625168a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaa4b76b-b81a-43c1-b6f8-b6294a5d018e", "sighting_of_ref": "indicator--862b95cd-4b6b-46a2-b530-4eec37d7ab45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987f8c14-7aea-406c-a952-b8c15d9446b5", "sighting_of_ref": "indicator--ae24db47-2391-41e7-b00f-d815c743168f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1678ff9e-2525-4e4b-ae42-7ed57b44cea9", "sighting_of_ref": "indicator--2b9c00d9-1bad-42b2-bb32-13c059a0bd08", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b8e790-e30d-4293-b208-81a7f4a8baa7", "sighting_of_ref": "indicator--f6b86f28-06d5-4681-99cc-863695a6fab1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f103e85e-7f6a-49a1-b32b-765851701c11", "sighting_of_ref": "indicator--aa8aaad7-ed4e-4e0f-8bb7-d72d410c9533", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4d7052a-aaca-47e8-ace8-be5d40aaf89f", "sighting_of_ref": "indicator--89af576e-3581-47d5-b9b7-aa06f1a932b5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5c27308-49dc-4506-be4a-99392fbf30fe", "sighting_of_ref": "indicator--6839f55e-f1ee-4647-a18e-6968fb67f9a7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b941269b-f2ee-4b90-a7e9-e37095d16753", "sighting_of_ref": "indicator--de168d7b-f6ae-4270-b1e8-6bc496aba292", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c8d2fdc-c212-45d0-8237-a1bf906e2bc4", "sighting_of_ref": "indicator--32628260-4620-41eb-ae6f-7b3e7a13a3ae", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d81d09f-8046-4358-bde4-8ad2ed4de538", "sighting_of_ref": "indicator--a7a7258b-f0d0-4599-8a51-65ce0192b05d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e55bd717-ab92-4e53-9652-68b6413b447d", "sighting_of_ref": "indicator--d63896d7-7fdd-43ff-a350-2645eb619d36", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8f0c7a-8d56-4363-90a3-2b9992b299e0", "sighting_of_ref": "indicator--4b534e41-a827-4888-a22b-be7c9af7c84d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd09525b-5c81-4729-aef5-18480b44747b", "sighting_of_ref": "indicator--3dd99fb5-d00a-4ace-9e1a-a28162b7ed3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40d1f80c-4fbc-46ad-9f02-7a7d4160b3e3", "sighting_of_ref": "indicator--627bf3c8-5fd4-4f98-89a8-2c2468fd0a83", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8654029-c78f-46b1-b8fc-9abc1bc19fb8", "sighting_of_ref": "indicator--56863f9f-d605-47ca-b9db-49ded1817905", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b253fdb-dc52-4787-a5fb-163da025c5b5", "sighting_of_ref": "indicator--602830b1-a2b9-43f4-9ccb-159382a24610", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7347af28-e125-4688-8aff-272685c52658", "sighting_of_ref": "indicator--9a5781c2-3432-41d9-8b7a-89be42e98d3d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e7c33c5-9256-48e7-b8f6-f71ebb33c12d", "sighting_of_ref": "indicator--341530c0-e4aa-45e0-8eac-61215b6c5d9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0532a2c4-dfd2-40b3-9e31-5356b96ccba7", "sighting_of_ref": "indicator--4a1de8d5-d75d-4d5d-a409-c1c6c71dc7db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc0d8c83-fb44-4db2-b3d3-0c2ef1b7d390", "sighting_of_ref": "indicator--b70ea9eb-a103-4b4c-bf0b-de3a09687927", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f4f7e41-3195-4969-8087-aadada9d06d3", "sighting_of_ref": "indicator--c2561a92-1db1-4c19-bfca-871d1b0b0220", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e00f5f-bb3c-4961-aad3-2b587a7029c9", "sighting_of_ref": "indicator--d622bb31-44c3-4b3d-8952-d932b828859a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--965b3c32-5d25-47d6-ade1-b74e3cd9ee9c", "sighting_of_ref": "indicator--3683662a-6a76-47cc-81b8-f159bb26fa05", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de73b5af-16fb-4569-8ef2-47621ad678de", "sighting_of_ref": "indicator--e197046e-ed04-4586-bca0-8793efde2bfc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9334275-4b49-4646-9342-4d586ba8f3e4", "sighting_of_ref": "indicator--dd8ab4a0-aa2d-4f00-bf21-30ceebce8557", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b091dc74-d757-4d74-ba2c-593aa67d8205", "sighting_of_ref": "indicator--0405e1f2-b846-495e-8b53-898a73982881", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--881f4540-7eda-4870-aeec-e2c2638d2c7d", "sighting_of_ref": "indicator--d698a7a3-ec1c-4017-b704-f7aaf47781b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fa5baed-f415-4eae-9c46-b8d42628a339", "sighting_of_ref": "indicator--64ac9e02-aab1-4aa9-a9bd-6c0e3ae9ccdc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d5cc868-c28d-41d7-b41d-c548be99fc25", "sighting_of_ref": "indicator--64ac9e02-aab1-4aa9-a9bd-6c0e3ae9ccdc", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ea664f5-ed6f-4576-b1f4-df7d06462772", "sighting_of_ref": "indicator--64ac9e02-aab1-4aa9-a9bd-6c0e3ae9ccdc", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6d83235-c8c0-48c1-a63e-fd735ef1ac54", "sighting_of_ref": "indicator--472f13b7-683a-42a6-9a33-0e0f520df3fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcb08295-d851-4ffc-9e18-ad56a73f93c1", "sighting_of_ref": "indicator--70dd276f-e1a2-4886-aef3-0a27b4d1e2e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b4beff4-da0e-4ee2-8b90-41c80a7999f6", "sighting_of_ref": "indicator--f06d6b0b-4b0b-4fff-842a-55373d2dea83", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2253e26-b8bc-4594-a8b4-1edd76482583", "sighting_of_ref": "indicator--1a4a2f23-c7a8-49b6-8b9c-b186adff1a92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed02272b-33ce-4525-b214-8c9047146b05", "sighting_of_ref": "indicator--38b1126b-a40b-4904-a1ce-6ec4358b6946", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9f4e012-a142-48cf-a158-a9d808341989", "sighting_of_ref": "indicator--3acdd25d-080a-4987-8374-406c9cdd9547", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16587c9-1ff8-4c1c-97c7-0887d21a4182", "sighting_of_ref": "indicator--83974f9a-06a3-42c2-89de-29c92811711f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8010d578-70e2-452a-90cf-ea7eff8e86ba", "sighting_of_ref": "indicator--e4c00f0c-c667-4048-8180-dae981aa4757", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bec0644-682a-49b4-bc63-4af3025be7e7", "sighting_of_ref": "indicator--d398e70a-9978-48de-a8e6-1962a93c5f57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f62dca3-8fef-4adb-8af9-ba7da488b175", "sighting_of_ref": "indicator--f512d694-381b-4369-95d8-024dde04ef52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ecc519-4278-4c1a-a6e8-d49bb0175c5c", "sighting_of_ref": "indicator--5f0c1160-34b5-4d18-a10d-34333debfdaa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813431f1-d355-415a-a198-348d2fd053ef", "sighting_of_ref": "indicator--1476697b-3e59-4df2-8000-7a5a3da723eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6b7df74-f685-4946-9112-4cfa036e06fa", "sighting_of_ref": "indicator--940386fc-232e-44c4-87d8-288535cb6aea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f3a1882-39d7-4d02-85ab-a6ab33e2ee61", "sighting_of_ref": "indicator--e920e795-26c6-4828-87ff-5dd9c94d0465", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed270800-4ce2-48fd-ab51-29eef9fa221e", "sighting_of_ref": "indicator--ba983d20-6cf9-4f98-a51e-b2cf4081a256", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d41ac25-eb77-4986-8381-ab40bdc856e9", "sighting_of_ref": "indicator--ba983d20-6cf9-4f98-a51e-b2cf4081a256", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--025db09a-e1fb-4469-9fb1-d3abcfb36d9e", "sighting_of_ref": "indicator--f5afc956-3141-4be3-9a1c-4127e4b64105", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b252f6dd-f9c3-4ef4-b8a1-81fc20f3e7ca", "sighting_of_ref": "indicator--6f0fe1b9-627f-49f9-b7be-7bb2bf64b49d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--531c3c73-ad59-43f7-b1e8-7bb783ea4096", "sighting_of_ref": "indicator--e165964a-e372-4540-847b-0fad533d1e01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79c635dc-932c-4a11-b269-204851e5d042", "sighting_of_ref": "indicator--305e356b-9a72-4a24-839f-93bf87c07792", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7d4b651-0d5e-42e5-91b0-3a89a132a4f8", "sighting_of_ref": "indicator--eca0e17e-e07c-4d3a-9a5d-d65e15e1ea0e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efc4b228-5bda-4ddc-b7ed-72e0beccd929", "sighting_of_ref": "indicator--ed356805-238a-4ff6-ad46-24d3fe1d007b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3465a5-dd78-4306-99af-b19e416aa774", "sighting_of_ref": "indicator--89547c0f-aff0-4606-ab82-28ad92cd5406", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95390c1a-bc79-4f12-91e5-7d163cbd56f0", "sighting_of_ref": "indicator--1643e33d-54cb-4e08-947c-84a99eb969d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a02528e0-e48f-4247-acd0-b0629745dc6b", "sighting_of_ref": "indicator--362d9bb1-b59b-4e8b-95ec-5b1c1c80a688", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1369f8fc-290e-45c2-a2b9-4dc57ed039b1", "sighting_of_ref": "indicator--8aea81b6-cd0b-4550-9594-ad6ecbde2ae0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a4b3d1-6f2d-4f27-811b-9032365efc66", "sighting_of_ref": "indicator--bf586d02-14af-4e46-a329-3890b6fc5594", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb7a976d-2d07-4e88-ad20-22436d253d47", "sighting_of_ref": "indicator--4da64a52-24ce-4424-a640-16af676c097b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3880b4b8-a8c9-4a3e-9d25-ab04b6558348", "sighting_of_ref": "indicator--8538c566-f149-4aad-83bf-212892b93bb6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf3df72-51b6-4a29-83bb-7702e865f389", "sighting_of_ref": "indicator--736882c3-4e40-43a1-9708-bb3928429916", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82a338ca-1d02-4e13-aff4-bedcf473a712", "sighting_of_ref": "indicator--782764f5-20bb-442f-b130-99f9ed2448af", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417643c3-aad3-4df7-a01d-f974ad44015e", "sighting_of_ref": "indicator--c508ec6c-8e61-4ac0-8c36-08963d412843", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--470fb1d8-5818-451d-866b-b2b3d75800c1", "sighting_of_ref": "indicator--ed875142-5f03-4427-8bcd-387a90302dd6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--986a886f-c6a3-49ea-9765-3b34ff527867", "sighting_of_ref": "indicator--6fda7e35-b32b-447e-a8db-016d63423903", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bda9423-28e7-4997-8b1c-5e25e20b0b79", "sighting_of_ref": "indicator--ecdcf468-5b69-411d-83ee-ec58c4228ea8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9069c34-9420-41ac-8a1c-148970fa7b0d", "sighting_of_ref": "indicator--72affa20-a5e9-479b-8d02-c0858455d438", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ccd87bd-ce37-466c-b5ce-ec7bcfc93742", "sighting_of_ref": "indicator--c2a41b6f-a08a-405e-a01b-ab701cb79a76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e757dfdc-733c-466d-99af-280602c8ce36", "sighting_of_ref": "indicator--6af0df57-a216-4071-9fc8-1b5ec28856bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ae7400b-c352-42a8-88ce-dd548515ced9", "sighting_of_ref": "indicator--92c1aa85-220d-49ec-b5a3-c529c110068a", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b57d1a41-7120-41fa-8b81-41b5a09fb9ce", "sighting_of_ref": "indicator--ae421a09-bcb8-4a44-b5ff-1c32eeb7e281", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--273bf558-a94a-46bb-a91f-176ebaf1307b", "sighting_of_ref": "indicator--39815231-73d4-46fe-ab17-4391cf56303b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21bfc38f-c7fa-417d-a1cd-104c9bd12ac5", "sighting_of_ref": "indicator--a9a195ba-1dd4-4f78-9994-6265fe5a3ef8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ab69ad-90ff-4dc5-a58d-325db25f6be2", "sighting_of_ref": "indicator--c8f0d7a1-7ab4-4251-b294-86b3df92a8c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--200745b5-5e47-4cfa-912e-c74a7657e51b", "sighting_of_ref": "indicator--6546f093-480f-4502-837d-dcc9b10da819", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cd87088-5bb0-4a7b-a76e-56e79633aff8", "sighting_of_ref": "indicator--d43534b1-aefc-499b-ae92-e0e9ec33bd45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bd164dd-7613-48b9-8c4b-463412b07b4e", "sighting_of_ref": "indicator--8d3dc3fa-632d-4777-a734-7f33fcaac31f", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f41e3521-40c3-4e12-a1d4-cff3fbae5fb4", "sighting_of_ref": "indicator--f3817211-c6ac-4ec5-b90c-1d01f906fd75", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93568f1f-a3a1-4726-9792-37b0fc0f605b", "sighting_of_ref": "indicator--b647b724-eb59-4fb5-8815-d0fbedb7adb9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f00d870-21b7-4689-8bae-ee2885ec34a2", "sighting_of_ref": "indicator--b91b4d89-c147-42f0-8f28-5d312f510dfe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab2118b-832c-4d46-a314-3abeb2b63bf8", "sighting_of_ref": "indicator--7d0d6e61-98eb-4054-a452-6c04e5dcac27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0a541e-d1a4-46a4-8772-1909bb535785", "sighting_of_ref": "indicator--12bddab4-1dc8-446c-81fd-e65f5068c2ba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09db1335-2bc8-49aa-b49f-434ca9ca5c15", "sighting_of_ref": "indicator--a8c6228a-b562-49b0-b1c8-74874c1c7e7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829aed27-8317-4143-8a79-def3fc4e3efe", "sighting_of_ref": "indicator--3584dac2-3fd5-4d97-9fb6-7b15855a3ddb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f1f64be-4beb-4b8f-ba5a-ba143eadd6c6", "sighting_of_ref": "indicator--89ed240a-6fe8-4658-8087-b4996ae23e0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184d3c10-e20b-4227-ad73-16db4a9e441f", "sighting_of_ref": "indicator--e05bfae5-356a-4b62-8855-c8ce6ca8de3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eced4f0-13bc-45c7-a448-0aaa4f46e8ad", "sighting_of_ref": "indicator--581d85eb-84bb-45de-9808-9ec9496d0bab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--911f7515-6247-489f-bd09-06ca356bc14b", "sighting_of_ref": "indicator--e86fa439-4d47-4f84-87f3-021174bd84f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cee2944a-8876-42aa-ae0a-1da28cf0a341", "sighting_of_ref": "indicator--589f6839-21b9-4227-bcc3-5e351cb6d2bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90f9371c-83f4-4663-8921-0895dc81278f", "sighting_of_ref": "indicator--6d7aded8-8fad-4b19-a9ee-751f3c5c081c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cad4e3f-cbed-436f-8772-37acc1e2be9b", "sighting_of_ref": "indicator--867b8f25-c7d0-4525-9d8e-7f26ab4f43ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9918fb67-6a69-4aa5-9a36-5c0af8c13db3", "sighting_of_ref": "indicator--e13e3d8a-6321-4913-bd57-afcc6f962232", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b1e1a2d-6efa-499a-96d4-8f5777042a2d", "sighting_of_ref": "indicator--6ce9bf9c-8d9f-481f-9b46-78ac6e9d4bde", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a11a7b7d-6128-4315-97ef-c090ef0a5a31", "sighting_of_ref": "indicator--834ae1c8-6925-4659-b544-78a1ee6975f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f8f0665-4c1c-4b49-9ad4-e4f42d9d6919", "sighting_of_ref": "indicator--3284451f-f6c5-4d02-8589-6962d88f5951", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80ae1792-15dd-4734-be86-c0031e8f80a8", "sighting_of_ref": "indicator--cedd7181-b0a4-4bee-bea2-b4cd48522287", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--397ffb3a-7b24-49e9-9d46-d94cbfdb9f30", "sighting_of_ref": "indicator--b08dab90-2c0e-48bc-885d-5e2615dc171f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e011e27d-79bb-445d-b237-288eb8e4c7d7", "sighting_of_ref": "indicator--82cedbb0-a797-4f76-8eb5-879441d403ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--348f8b7f-2c4e-498a-81a7-dea6da74ca17", "sighting_of_ref": "indicator--ffb47b53-b226-48a5-b059-631f756fb08f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d5cd0b-ee3a-4b6c-9a35-a6a10e216400", "sighting_of_ref": "indicator--f134e95b-3707-4a4b-9fa9-1caf08a1cc02", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b806b198-fe64-499d-b218-c571a5bb19d5", "sighting_of_ref": "indicator--d31b1e16-bc99-4b6b-a472-ea9a75d585b5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52900063-1e31-464b-96a1-ac2363fcad29", "sighting_of_ref": "indicator--d313cbf2-d51c-4155-8502-013192bb37cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--522b296f-8d3c-4c85-955f-4102a57d80c7", "sighting_of_ref": "indicator--cea36509-6602-47fc-91ab-2f7edf09230f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4b10ee-0559-4663-a76c-f69ee1a9abe1", "sighting_of_ref": "indicator--ef69bb95-0c2f-4782-8b5f-de48bfd800ac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--818d73b9-e980-4ad1-a973-4d2e4514e38d", "sighting_of_ref": "indicator--700c4a06-37e4-4a95-b9f6-1e04ee9d2c40", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2358b44e-a268-4183-9224-ef2b31d49e2b", "sighting_of_ref": "indicator--06c8350b-9b97-49c1-992e-66f6ab30438a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5019ca7-2008-43bc-8d92-74d3bb2c9078", "sighting_of_ref": "indicator--96d8f613-1e8c-4524-bb31-ab717e8e3d7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa50b45b-e7ae-486d-8457-ec499a9c63e4", "sighting_of_ref": "indicator--f250fdbc-352b-4e38-9126-42daa01db509", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfbf0e55-4a3b-4c00-9580-a2122d37279b", "sighting_of_ref": "indicator--f9437df0-61f9-47ed-907e-d47ef830844a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--157d9b6b-4f50-4f0b-885b-76d18c1205cb", "sighting_of_ref": "indicator--0b127fb9-c874-4c16-b314-ec7e5da956a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b1f9383-1b50-454f-b6ac-3c2dd9d314b9", "sighting_of_ref": "indicator--787ca025-3a95-4f59-b19c-4cb11a011112", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00572a09-fe31-4204-9cd6-9bfd00615cd2", "sighting_of_ref": "indicator--81961dd4-da57-46f5-8308-0e407d9e223b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55487c5d-2268-499a-8ef1-9b1cff1d6928", "sighting_of_ref": "indicator--4a39c4a9-9294-4ee6-8881-2c70f2730e13", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c16f59bd-c889-4832-9928-e8208a0a439b", "sighting_of_ref": "indicator--8b4bdee1-441c-4e94-8e7a-72b4f13d905a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e39db9ed-e94a-4e02-b19f-5e15cbcca8e0", "sighting_of_ref": "indicator--455bb0d9-77d8-487c-8ec6-20376b2a2652", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a5402f-1039-470b-985f-7e874e4f38d7", "sighting_of_ref": "indicator--62c3f94b-c7ba-4fd1-86f2-227e29047162", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c294701c-64c2-4388-a524-047a3edb13a1", "sighting_of_ref": "indicator--1980fd1e-eb92-4496-8eec-7a7302fa35b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbd8dcac-c688-42e0-a044-f46457769d14", "sighting_of_ref": "indicator--b597d51a-be53-4da1-aa88-45a986b4aef8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec89a6d5-d6b0-42d8-9ee4-802d2b509690", "sighting_of_ref": "indicator--6f40eb3b-c25a-4c49-bf8a-58a3c97b6521", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39b46a1c-5632-4dd3-91b3-1547813b397a", "sighting_of_ref": "indicator--85ea5a77-60dd-487c-a31d-242e002285fb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81466594-5425-467d-89a0-133e52e14cf0", "sighting_of_ref": "indicator--7dc9257d-6923-4044-8631-821717e3bb0b", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0a757ed-87d4-4dbe-9aa8-24d006b022c6", "sighting_of_ref": "indicator--714e1f1d-da0c-41dd-9f12-5ecf39b39855", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e85cc39b-2c5d-4fe6-ab67-6ded39182202", "sighting_of_ref": "indicator--a0bf3fad-a5c9-4804-8305-fe411297813f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c77d78f-b9f5-484b-a215-81820644f8ab", "sighting_of_ref": "indicator--b1bd6360-3c5d-41bf-aed5-2079a5faedc5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69a2137-70c1-4690-959b-b7a260371003", "sighting_of_ref": "indicator--41528975-848c-4d29-9220-fabf1af4ab37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26150afe-6dad-4ccd-a432-e13b644c5d3c", "sighting_of_ref": "indicator--77115ba4-27a0-4fb1-802e-c6daedfa3307", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45df2841-7eb4-4d5d-a0ce-71f6d4e88e65", "sighting_of_ref": "indicator--2457fa92-fcef-40d9-853a-bb10378052a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d084a1f-eae2-4ee4-b8f3-ffb8b396ea6b", "sighting_of_ref": "indicator--f0eb2c7e-82a2-45dd-8ec5-75cfefc97395", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6ef13f-7b9e-4f00-84f3-c0378d9b3048", "sighting_of_ref": "indicator--f051e922-7490-4ef0-bee0-69e39b1ed929", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f09b04d-601c-4088-aaf2-da70153a95ac", "sighting_of_ref": "indicator--29bac3b4-423a-4281-8fd6-1330c7f3e545", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58cc6528-108d-4886-95e7-afa6a9dfb3c4", "sighting_of_ref": "indicator--c17956ae-8177-4b63-87b4-2421fac05dee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5333de7-8d2e-4586-ae56-1848ca932310", "sighting_of_ref": "indicator--5cee465a-f65d-4449-b75d-01a1086f8b2f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c724f9cb-06ae-4fbc-b721-7624d2e1149c", "sighting_of_ref": "indicator--a964936b-2ee8-4bfa-b0b9-2c8f5e8b3283", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b816fe6-c4e4-4e00-b21d-9f5cae595df3", "sighting_of_ref": "indicator--c5a80480-235f-40f9-86e4-6dc5852da291", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--035d9fa9-53d4-432b-a6fe-82f7e5ea1237", "sighting_of_ref": "indicator--e302509a-caef-447f-9ea3-92bce3455c2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01f760b-24e0-4b20-a7e1-471fb49b83c6", "sighting_of_ref": "indicator--68381768-1c35-4cc5-9040-ac46cfbb51a8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64828f30-a503-4cac-a9b5-1dd00538080f", "sighting_of_ref": "indicator--4360c799-abb5-49ec-b03a-b5db257541e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--116addc7-3018-4aaf-b50b-2ab0a55fa5af", "sighting_of_ref": "indicator--a07e055b-143d-4dd1-aee1-a210e0ff944b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47df5e49-e6a8-46a6-8643-d331df141cdc", "sighting_of_ref": "indicator--fe271b4b-bcd1-43aa-9e50-1426020a1d94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f4545b-6333-41f7-afbc-93d8444865ba", "sighting_of_ref": "indicator--e6983f6b-263d-4cf8-addf-1ded55484bab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b3fc92-868d-4e50-969e-d225d5378e0a", "sighting_of_ref": "indicator--e22ea8fa-fb07-4b03-9033-db16c14cf0e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d42865-a94b-422c-b65c-ce826c014c88", "sighting_of_ref": "indicator--1c619c11-1b59-4f8e-80f5-23af1fd82ede", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79823fd7-31b5-4266-8bc5-0a7ba40e695b", "sighting_of_ref": "indicator--59a89366-1ee1-45b7-9fd3-089eecb9b40f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98bc2623-8c2d-4f3b-9fbc-b01d3dac40ce", "sighting_of_ref": "indicator--50be187d-9fc1-45e5-9a3f-04cd18c670f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a9b6de-7564-464d-9928-8584bfa1980a", "sighting_of_ref": "indicator--654eb127-ec16-43f1-b2e7-ac69b37d23f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--275e7cef-e5ee-4346-9255-4b6849bd5657", "sighting_of_ref": "indicator--1a8f4969-722c-4654-bad9-a1c35fadbc60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--389ef8a4-ed51-467a-a065-e03350b426cf", "sighting_of_ref": "indicator--4091f221-481b-4512-8a8b-80ba0bdbe308", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d25cbee-ade5-4965-9e36-7a7dbdc8586d", "sighting_of_ref": "indicator--5fab2fc7-17f9-4334-bd9f-bd5b27963c23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc4cf8f-5374-402a-85cd-78b9d099b3bb", "sighting_of_ref": "indicator--00334a95-1274-42ee-83f2-71489f00f282", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c9ea3d0-4d28-4525-abdb-a47c06ab083e", "sighting_of_ref": "indicator--3d67c511-c5f5-4fa9-a5b6-8feababb5fa0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6260f9d8-1e63-4aa5-b64d-493e5daf094d", "sighting_of_ref": "indicator--38fbebb7-680e-42c0-adb2-039be989472c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd38b26f-64ea-4720-91c6-d8dc3b0e44af", "sighting_of_ref": "indicator--1258cfcc-469d-4577-85ad-d9f10f37286d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4c1a9fd-6122-42b1-90ac-8d3e9121965e", "sighting_of_ref": "indicator--59079115-fb35-4890-8022-7525ab594f12", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e55216e2-f321-42bc-9db3-65296b456d2a", "sighting_of_ref": "indicator--f94021bd-3b7d-4a7a-a6cb-24763565a785", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--066b480e-2266-45b3-a843-e06b034317e6", "sighting_of_ref": "indicator--b7f1ac87-b20f-4a6c-864d-77900b96fd70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c743c504-7711-43c1-b4a0-46b44b5754ce", "sighting_of_ref": "indicator--4b3c1c2c-3a4d-4dac-982b-2f1f3110a21c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9f4f7d0-2ece-4ac0-8723-7a7c4c51513e", "sighting_of_ref": "indicator--34411320-1837-4172-85f0-1a5f4d3d637d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d66ab18f-9cfc-4a3d-8525-1088c83e92c6", "sighting_of_ref": "indicator--09356314-47cc-4ab0-9d0f-24f1e2f5ec5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64061836-d96c-4b84-a5d1-ab45ede174f8", "sighting_of_ref": "indicator--0dc46775-0eb8-4b59-8a16-155a7f83bc6a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5093a7f9-ef4e-4009-be17-de4b30d2a1ab", "sighting_of_ref": "indicator--aac75103-1c69-47a9-87a9-98cab9e60d6c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76687a45-9ca7-4c56-ad09-527595641d1c", "sighting_of_ref": "indicator--c12c5f1b-ef3c-4204-bd2f-220d67d4b101", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8fd6e3a-c88c-4ce7-9944-d5ef4230979c", "sighting_of_ref": "indicator--d1639317-c1cf-4ee8-810b-69dd9639fb51", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d420269-727f-4a95-8bdb-7663ee14a9f6", "sighting_of_ref": "indicator--98437af3-9bef-4127-86fd-f42bbea7e11f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ac27179-a606-4217-9e35-8924481719de", "sighting_of_ref": "indicator--91ba1937-8878-4340-9ad4-ce082eb3fb12", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5fa1f6-3af8-4d0b-93bf-93eafaff27af", "sighting_of_ref": "indicator--5ec2e9d6-7341-4930-9b9b-b000757d40c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9341f53-92c7-4af3-982b-2d4a29fca569", "sighting_of_ref": "indicator--ebdc29d8-a2c8-4a78-9668-9e964a5aefd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73b0a433-a8f6-4ffd-b810-3528f7ef28c5", "sighting_of_ref": "indicator--1bdecdd1-7783-4124-8ac8-6cea88c8c656", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc72fd8-4e4f-4763-bbaf-cd0393ad6b07", "sighting_of_ref": "indicator--c167e132-3bbf-47c0-998c-83e14afccb0f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9043f008-3577-40b1-b78b-ea435484be42", "sighting_of_ref": "indicator--0db1e6b4-b26d-49f6-a431-4bc0bb22dfeb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6db5cf2-5709-4c35-b5ef-81db023726c8", "sighting_of_ref": "indicator--98e85c73-a165-4d38-acf5-862448e9dea6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fd4a316-8a5f-4dd1-beec-277e3754a034", "sighting_of_ref": "indicator--625ead34-4394-4817-b9c0-287990501975", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124b915e-c237-46a9-92d4-6cf3a193a086", "sighting_of_ref": "indicator--3151ca1b-bebb-4084-aebb-201d741ec710", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da101e0c-6adc-40b6-b224-b25ec9d1117d", "sighting_of_ref": "indicator--1c72db86-2cf7-448f-9a84-e3edc3e99c54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa9ffc8-3b06-4ea5-84bd-c624d4589832", "sighting_of_ref": "indicator--75ab9ec8-b1a7-4761-ba08-d2a607f0bc01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a10e81-0418-434d-855e-9a29e0e584bf", "sighting_of_ref": "indicator--e00ccc63-664a-4a77-878a-a87911d77355", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a3423b-66c8-48e1-ab6c-a383b399acda", "sighting_of_ref": "indicator--0ea35f79-d59b-4316-acfe-db571f175e54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--668a923c-1972-4512-b4fe-1a1df5d57c50", "sighting_of_ref": "indicator--22da2a56-9109-4abd-bf36-19273aded3d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11ef237d-a987-471e-9d42-48f25464bf0f", "sighting_of_ref": "indicator--886ae8b8-62dd-41d1-ae14-73923082ff30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4efeb2bb-f440-4be3-b27d-0df1b960b556", "sighting_of_ref": "indicator--b04a661b-6e60-49f0-9a69-cd3dd95c2fee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9125ad6-a6d9-4022-8a05-9d89fae5506f", "sighting_of_ref": "indicator--76803637-6cef-4ed5-9b5d-3aad5cec3b4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c819c9e-902c-4edf-b90e-923f50856675", "sighting_of_ref": "indicator--5b22c2c0-96ca-4edc-8286-89445f107046", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ef5a985-a862-44bd-953b-f06a8d135115", "sighting_of_ref": "indicator--4f7a0930-3ac3-4b5f-9fc6-974497c1e2d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac6ccdb-4189-429a-ba3c-934b9f81d6ed", "sighting_of_ref": "indicator--743ed5ce-9ccb-47d3-9cab-2316dc1f34b3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--472cddb0-7315-441b-909f-83957deec6d8", "sighting_of_ref": "indicator--a3a4e984-0334-4742-bce6-7e7c4884a7c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9958c0-7cb9-4ae3-81bb-68831ff7ec45", "sighting_of_ref": "indicator--c892d35a-baa2-47bc-ada8-5e7354dbb11d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc99b45d-a071-42f7-908f-75c0c7d6fac9", "sighting_of_ref": "indicator--1411f784-5a49-47d2-b4b7-05f7b3e806db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23b21964-0b03-4a09-8d66-f05af1c4bb8d", "sighting_of_ref": "indicator--e516ac72-7bb3-4576-a098-8a741d850758", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b8693d-59a7-41ce-aa0b-7bfb266f9abc", "sighting_of_ref": "indicator--1dda1754-7639-4471-8671-6e11f243c05d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7d6a0c1-2198-4c22-8862-ca8901271ffc", "sighting_of_ref": "indicator--a3ddcb5d-4dd0-40b9-91c6-e0d1f030347f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23cd3032-75d6-418b-b0f5-b00ca40b4d35", "sighting_of_ref": "indicator--ecf2eb79-f284-4b5c-a2c0-5541075e6a3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d888ddc-8449-4737-86d0-dbd67fd5ee8e", "sighting_of_ref": "indicator--6884e31d-6f98-4913-b51c-7d8ed9d5a905", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43cb97d7-ff38-4048-8867-f06eb5e41d9d", "sighting_of_ref": "indicator--179ef1e6-f7e0-4732-ae37-5f40577b2c53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bae55aa-9f94-4055-b930-b295ace2256a", "sighting_of_ref": "indicator--7b96df02-b4b3-4a0f-b39f-fc15af1981a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4596b73c-c354-426e-b19f-8ed91215c7e8", "sighting_of_ref": "indicator--b4f0014a-ec44-46c4-8a33-0485a3267544", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c55378-b29f-44f5-8794-021a02da8a47", "sighting_of_ref": "indicator--a61e3f6f-7897-43d3-940b-72b5b546b118", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60d7e5f9-c28a-41c6-a510-40029770c211", "sighting_of_ref": "indicator--6880e8c7-9e25-4d78-b113-235aac3be52a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f74c3151-7848-4d93-9e5f-7d01e7c0fa31", "sighting_of_ref": "indicator--47bf4566-561f-4b80-a9da-c15060e1e5f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55570df1-9036-4768-960f-db48c1cc5ef4", "sighting_of_ref": "indicator--d9841c34-2bfa-44ff-a114-58e0af76f071", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a2ba4c8-38f9-46fd-9046-c1e2362bbe1d", "sighting_of_ref": "indicator--faa67c94-b744-4f12-9053-365f393ea7e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe99033e-0c94-4a75-8596-575b21814b49", "sighting_of_ref": "indicator--e9a05017-6e32-4b26-83d9-894284248d01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc79756a-3bd1-437b-8fee-69a71fa4b532", "sighting_of_ref": "indicator--d4fad7e1-41d8-4a7b-920f-8ea875da966c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4da523d-17bf-43b0-9357-12ccc05050dd", "sighting_of_ref": "indicator--e28b237b-655e-42fe-a4b9-135048675cdf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12af1726-0a6b-4955-9545-918e34c674a8", "sighting_of_ref": "indicator--27f73235-1fa1-45cd-bd1b-631b8f42e453", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e75d45f-0918-4de1-97da-148a1138f4ed", "sighting_of_ref": "indicator--84ce0ee2-009e-4430-a78d-b5757e2e41c3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ebdbdad-94ec-49ac-9f08-f99dd89f5ded", "sighting_of_ref": "indicator--185de750-7c61-448d-a12c-771138654b78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfa5944e-76a0-4906-a202-33d3fd092f4e", "sighting_of_ref": "indicator--6ee5b64e-7ebb-4e92-b303-7e84407b397a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec5ff82a-1463-4ae6-a30b-a6879a67e4b4", "sighting_of_ref": "indicator--82f9dcb5-6356-4c5a-ad2b-4dd3f0e7e1eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba3d7f80-867b-4792-9ee6-3b6a8ba8c59b", "sighting_of_ref": "indicator--8c3370e8-6154-440b-9edc-c351d3e7cff9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5847e919-b9d4-4ddf-806f-f62282372772", "sighting_of_ref": "indicator--845bb043-c991-45bd-a51a-24295744356c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d83d24f-b572-4221-bdee-b00a53f79921", "sighting_of_ref": "indicator--4d772e8a-9a71-4792-aa38-e126464fdc5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9383792-0133-49c4-8a6c-cd76bfd62d25", "sighting_of_ref": "indicator--c9cd4c3d-bd55-46ae-9a44-cb19cbd5d07c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--968e7571-5455-4c44-8329-333ea2ec10f3", "sighting_of_ref": "indicator--962a92c4-9278-43bd-965e-8900ea9313e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5e4e3bd-dab5-40f0-88fe-e0c266358d87", "sighting_of_ref": "indicator--dabe5023-67a4-42cd-a508-1201b71f6934", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be59d113-e848-46d0-ba4c-5e97863bc6d2", "sighting_of_ref": "indicator--76ebabb3-cb0d-4183-8bcc-a70988020cb0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--448bbbee-2496-44b2-8e0b-9a861e7594c1", "sighting_of_ref": "indicator--2a8399de-c8e1-48da-9c5b-20d378644f2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--272f33ab-1d21-4974-9e14-6d35a24281f0", "sighting_of_ref": "indicator--7105a69f-a68d-45f6-abb7-28d4dcc1fff2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5497c1c0-3701-4512-b466-d08f6733bbc4", "sighting_of_ref": "indicator--1e7e125f-be5f-4009-b26c-4170495686f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0eef250-d710-4e70-8aea-cf8762438897", "sighting_of_ref": "indicator--6f744721-5d81-4724-ba6e-c760a9fff08c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4c70543-4f91-41e0-8ff3-3c28afa04921", "sighting_of_ref": "indicator--6229f598-4218-4619-9981-dde82909716e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71975990-de04-44ea-babc-339b55539383", "sighting_of_ref": "indicator--caf75011-e8dd-4948-a591-236f2061c67d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce76ff2-e59d-4a13-8088-cffab71a970f", "sighting_of_ref": "indicator--545b47ed-79cb-402b-9a24-c34f57516692", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--006873b7-5945-4401-9885-337805e2458f", "sighting_of_ref": "indicator--5e4bd9b6-b4ba-48e1-8c1a-7e8361ad453f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deb681ed-e4d8-4a7c-8fa5-45dbe8faea2a", "sighting_of_ref": "indicator--bb4017e6-c133-4621-bc8a-3190e8303ffd", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf2e796-e808-46d4-af9f-a24b9003e4b8", "sighting_of_ref": "indicator--dbc63b39-776f-4f19-abcd-6b0e44371601", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--420fd6b3-2461-4ca5-abb2-4f97f3507547", "sighting_of_ref": "indicator--8ff782c0-dd52-4699-b4a1-7d724b258cbf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--910e1fe3-106c-49e2-8bfc-cb02abe839bc", "sighting_of_ref": "indicator--ef531d19-e526-4cec-a856-2be9f069d1c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5e1497d-4cdd-4a47-ad4f-18395282dcc7", "sighting_of_ref": "indicator--f0e62aac-22be-41de-b3d7-702362097bd8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f76ed141-3515-4683-834a-c49379fe2770", "sighting_of_ref": "indicator--e9cc7251-a7d2-4397-9fb5-66b050f7aaa2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cd543f0-5a9e-40e7-a01d-5f8dfafd22e5", "sighting_of_ref": "indicator--53e08a6a-9596-434d-a4ca-02e3a4ef39ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40d833fd-c202-46f2-86c6-cf49310ac1dc", "sighting_of_ref": "indicator--fb7e1a3a-7e48-4755-935d-d5443a99661c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d53ed167-c82f-4475-ac7b-70e84f72d170", "sighting_of_ref": "indicator--18ff41af-58d1-4d6f-8e05-1804deaac049", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57b5304-3734-4e5a-860b-ffe7192c1171", "sighting_of_ref": "indicator--5552967f-02aa-40ee-9a35-73f1a8d7004b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2c845c2-6f3c-4f63-86ee-7c354d1f1e1b", "sighting_of_ref": "indicator--aa0c82e5-eb44-485e-990c-35966f5ce2e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e8c1b6d-d37b-461e-81a1-57b834915e10", "sighting_of_ref": "indicator--b4039722-ede8-4708-b3ed-0431c21f0e61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7cc084-6013-4e5f-9a4d-d5c806fd7ca2", "sighting_of_ref": "indicator--26056ca4-e6f2-49ab-a8f3-d07fb1220e96", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3590ff-04f2-46d6-870c-ad95cc204989", "sighting_of_ref": "indicator--34efc34e-a35e-43d6-bf28-87cbeca610bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--763ff320-c01e-4da2-8ec2-2e58aba4cd73", "sighting_of_ref": "indicator--df321744-6806-499b-989f-a17ad6221727", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e488331-9a2e-4411-942b-ddf51b44d161", "sighting_of_ref": "indicator--d079c6da-8b96-4a9e-92bb-34c57d4284e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9373258b-2c1f-4269-b853-3bd251808d54", "sighting_of_ref": "indicator--0142a2ff-4bc6-4eab-9441-ab123648d9d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41bafc31-f7fc-4fac-bc08-9736fef021a4", "sighting_of_ref": "indicator--5f1b8c28-cb20-438e-beab-9edb277fdf2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37cb54c3-6a6d-4ad4-a0ca-2852a3493501", "sighting_of_ref": "indicator--edec786e-e012-47b9-8d76-83225c37f1d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9b8b33e-05fc-49bc-9acd-83f6fccc35f6", "sighting_of_ref": "indicator--1467bc37-06ad-4015-96fe-d7809fb1f267", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61bdad47-4034-43f1-9abf-d80ca33fb323", "sighting_of_ref": "indicator--0a916451-eb49-4220-95d5-9092dbe07c1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b347e487-417c-4817-861b-112e3cb262af", "sighting_of_ref": "indicator--15f9f591-4c8b-4cfc-9edf-c497662e7ba5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2c8ac2f-33aa-41db-9f81-7944bc0fc4d4", "sighting_of_ref": "indicator--4782e5be-e649-448d-baac-a8840db64ee9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a83b6ba-ece5-409f-b0a4-3e6b53efabe3", "sighting_of_ref": "indicator--76c8cdef-fa84-42b7-a084-1f814c8498f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a9e693-b30f-4bb3-a547-277345a0ecdb", "sighting_of_ref": "indicator--217323b3-d940-4d02-9d3e-24ab1325acd3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3656e120-1f55-4b10-a391-0bf01d3d5f77", "sighting_of_ref": "indicator--452e2b3e-b489-4651-bf3c-9c4672b4509d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2618b56-3a26-4ea9-9699-5f82c29d587e", "sighting_of_ref": "indicator--aeacdc3e-b8a7-4c35-9509-da7bc47e720e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a2d21bc-e652-4d37-b0cd-ddd684235438", "sighting_of_ref": "indicator--0198eb78-2cda-489a-9b8a-7669b0232336", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6489e975-1bdb-4b7a-ab7d-c7cb2040e66c", "sighting_of_ref": "indicator--407ea09e-c279-42c1-98ec-285888871b2f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182a0ec1-8677-44d3-9d0d-c9b191e89e5e", "sighting_of_ref": "indicator--ae9b17c2-3d2b-4607-aad6-3b7340f2ea29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e155473e-3446-4156-863a-28607d455f13", "sighting_of_ref": "indicator--791d3d04-2e65-47d5-ba6a-c4ef9caa27db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bbffe26-c159-4aa4-a7aa-6548d3ebe28f", "sighting_of_ref": "indicator--ac3493d1-6f4f-444c-9f98-2fe83d88f95a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ba369cd-cb11-44c5-af26-98cdea97b5a0", "sighting_of_ref": "indicator--418a4068-98b8-4341-ac6c-425d0a3f1d49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72b3a3de-371e-4b7d-b18c-57b7d3cfe1d9", "sighting_of_ref": "indicator--1ad458dd-6c92-43cd-b9cd-b3a54798c4db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc26c77-dd73-40e3-b7a3-fae84d0bcef1", "sighting_of_ref": "indicator--174f2651-ba57-4ef2-ae92-7159f29f9ebf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--095d8716-0d9b-406f-9e1c-c61412d9748f", "sighting_of_ref": "indicator--2a663938-42a2-47f9-b989-993a7478ffd0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a6bdc35-b074-4c7a-af5b-e5a1879f7d99", "sighting_of_ref": "indicator--222927ac-58e9-4ddc-9cbe-358b55af635b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a6ba64f-c086-4180-b49a-06445d6d6380", "sighting_of_ref": "indicator--227d5810-f1b8-43e4-915e-ff77686aee08", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6bee377-47a7-439b-b891-951fc13eb861", "sighting_of_ref": "indicator--9eada764-aa18-45cd-8c31-27471f090f7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc68d3fb-28a8-4d73-9e99-9bcd11895836", "sighting_of_ref": "indicator--769b9c0d-f3fe-4843-b8de-1948aaf065e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4606da4-4b97-4756-94a3-9c6ea8697cf2", "sighting_of_ref": "indicator--02d30476-4e40-4132-884f-72324acf0eeb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54963b5d-024d-4de3-b92d-8bd0f7051518", "sighting_of_ref": "indicator--e32004c6-9495-4cb1-a5f8-3563b5eff164", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ba4424d-2ca9-494f-a8e6-0e055cade139", "sighting_of_ref": "indicator--5ef1a561-2d1a-44e2-97ab-61091a1c47b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cf2a89c-78a8-421c-a159-58b435058dfa", "sighting_of_ref": "indicator--a42232b1-fc1b-4122-8d56-c67b8ac1c85b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c3d2a5d-dd6b-4fcb-a4ce-b51bb92671cb", "sighting_of_ref": "indicator--e8a8ef30-e7ac-4dce-a976-ac1e8c4eb982", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c97e057-15c5-4af3-b330-094c5410d198", "sighting_of_ref": "indicator--7e12569e-2887-4795-800e-7025f23a7415", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab38e6c-4e09-4aee-8888-2de1eda0e407", "sighting_of_ref": "indicator--064e3211-350b-4b9e-bc94-69639656ecb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b38ec9-f666-4b9a-948d-b6c529691af0", "sighting_of_ref": "indicator--930f9c03-89bf-4149-b8ec-29c66804921e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20621bf2-cd34-4e45-aad0-96422d032202", "sighting_of_ref": "indicator--c1caa969-6e18-4200-aaf4-77807d112cc7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c40889f-bcb5-4773-84be-b1fde0103a69", "sighting_of_ref": "indicator--655264a7-d666-403c-89de-60ce166b80b5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e14f670-bc09-483f-9c13-36adc4ea3da7", "sighting_of_ref": "indicator--e066d5e6-e7de-47e2-8f65-063653ea2bf1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89822d5-ae28-4fc7-bfe5-feebac830a73", "sighting_of_ref": "indicator--fe50b5f6-c08b-4e22-98d4-8c9828292b6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f561d272-79c4-4f69-821c-253c981071d6", "sighting_of_ref": "indicator--6f3f4419-2ae5-4c81-b226-1d2f91fab215", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7492bc4-8ced-46ab-8c5a-15004db6eab0", "sighting_of_ref": "indicator--bd9e20aa-c2eb-4572-9fc7-4ce6d05e5471", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5dd4478-ed2f-4b00-8ca2-fbee85a67a5b", "sighting_of_ref": "indicator--9b3996d0-1aab-4f95-8397-f7865f8016b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4769735f-64af-4339-a836-9c910c090a46", "sighting_of_ref": "indicator--fe276b0b-85f1-4762-89d8-7310a588f2d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bd29588-e1f4-4d8d-aa2d-bf34e5e62b2f", "sighting_of_ref": "indicator--6ca78d09-652f-4dd6-81e9-d6c39d93daa3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--583f1743-142f-40f0-9610-dd13fd47545e", "sighting_of_ref": "indicator--bac70d75-dae0-47ee-88d8-881eb7427889", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58434162-aed6-439e-b6b7-d464b7dfac62", "sighting_of_ref": "indicator--7bbb57d7-2351-4366-bce7-12726fab1cef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33cf9d44-e999-450c-86b7-6f9fa5a64e51", "sighting_of_ref": "indicator--9370734d-febb-41c1-9819-4ab19e188173", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dcbf427-2eba-43e1-89f6-066abbc5425a", "sighting_of_ref": "indicator--407cb9f2-cbb6-492b-bbfe-5308e5674a30", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf4f3dc-8fed-43b2-914e-fd2e2e88e219", "sighting_of_ref": "indicator--9140bcff-30dc-4daf-a2c6-2bd51c1f2e1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbf1bed-c101-442f-b2c7-8df6b5ca1e40", "sighting_of_ref": "indicator--d5e979b6-811e-4387-80c0-09faf8b572be", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c54792af-6c5c-4d23-9bb7-2bde55bc1a36", "sighting_of_ref": "indicator--9767ceaa-4c29-490f-a015-e04e24abe335", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91ae29a-6358-45e9-acc1-d640708be254", "sighting_of_ref": "indicator--4bbc9669-e501-4dfb-9cf7-b7456931abc4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7cae744-76c8-49c8-b9b8-f260568f51c6", "sighting_of_ref": "indicator--c92c99a3-55b2-4182-b9bf-0f848737afb6", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd4aea62-5e64-4e94-83aa-dfb1328fcd39", "sighting_of_ref": "indicator--1d166ff1-d180-4cae-848c-990780c14382", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccaef4c0-ad38-482a-905f-43bfd4bde334", "sighting_of_ref": "indicator--953397df-ea59-4476-8ea3-289251900e2b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--685b0de7-d2d0-4e77-b434-5f72fcbbdfff", "sighting_of_ref": "indicator--3cc226b7-8526-4312-a52f-3a0e00d5549f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3ecba79-884e-4b09-8334-63e730538bc1", "sighting_of_ref": "indicator--d7a621f3-7a69-49de-a30e-5539f6cda1b1", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f09a30-a1df-4739-9487-2f3bacfd2f50", "sighting_of_ref": "indicator--3883065e-f806-4572-b1bd-85cf7344f284", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b66600f-8e16-4a3e-a0f0-ff17536eb044", "sighting_of_ref": "indicator--431824f8-77dd-458a-8d6a-104936511552", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d1d9b31-646a-4460-8056-58ed788c3df8", "sighting_of_ref": "indicator--c38fc15e-343e-45f8-8e82-9649a9f6795e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43b3300-ae52-4541-b04d-06f40354318a", "sighting_of_ref": "indicator--8f4b0886-85ff-4d44-909e-d510c32eb8df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60c698e8-8ef2-4a34-b2e6-a5218a755957", "sighting_of_ref": "indicator--f77af372-f242-42a6-ab2f-d878420427a6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9306747-bf62-44fc-ae36-03ea0f7f50da", "sighting_of_ref": "indicator--853ff70a-956d-4c71-b4fa-d5a6499c6dcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d019a473-045e-46d3-8661-7a69aadf5c32", "sighting_of_ref": "indicator--fed895eb-bb17-4952-9d1d-a6e0ad6312a3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ecc4a3a-ed31-416e-a394-04ed05a2e68e", "sighting_of_ref": "indicator--1c3dc26f-0921-4bcc-9b06-54c020ef549b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955dfdb7-b54d-4da0-9c88-a930d118333e", "sighting_of_ref": "indicator--bb7e1808-9a03-4ff1-b4de-2a5bd61558df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8215367b-3178-4379-ac3e-52aa72be03f7", "sighting_of_ref": "indicator--dee9bbec-45c0-433e-862f-48ce193f2ad1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfe6372b-01fe-4c05-9af7-a8fd0297b09d", "sighting_of_ref": "indicator--faafdd0c-c26d-4d88-80c4-32b5a52932f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b935eef3-874d-4675-9f41-7d499096dab1", "sighting_of_ref": "indicator--14b15f41-e5f5-41c6-bdbd-7c1c08d5d9b8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db59edfa-01e5-455a-b056-faa17f7b2a4b", "sighting_of_ref": "indicator--52f87ba8-4bed-43d7-8f44-cda6d014b851", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--613e95c6-3180-4fe0-8b29-2c0d028397e0", "sighting_of_ref": "indicator--3c01f409-ade5-4e5c-ae08-97c0d4836ac8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4beee9-cd05-4e3f-9e4c-fe667a40fa60", "sighting_of_ref": "indicator--cfc6a9f7-75cb-42bc-a9a8-6169115e6b25", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b74e823-7138-46ee-b35f-c1f7e35b3044", "sighting_of_ref": "indicator--d9aecccf-328d-45f8-9269-f891b0135798", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6d45ea-c8e5-4292-9793-0191755a0c5d", "sighting_of_ref": "indicator--9b8afb5c-e3e9-4749-b50f-2c4e81d7904a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a1ad252-20ed-4f10-83c1-bae15794bc7f", "sighting_of_ref": "indicator--4bd8628c-e0e5-4040-8fd4-1e295447b761", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1ebcb21-e358-4dd7-891a-6261f382e796", "sighting_of_ref": "indicator--9d2fb08d-a0cb-4655-ab67-7d1209fcb6b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd0887e-75ad-448f-a76a-978942becdfa", "sighting_of_ref": "indicator--ce82424e-e7ae-4362-af9f-74e9290a50db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2abc955-069f-4dca-9661-dc969690cae1", "sighting_of_ref": "indicator--367152b5-ad9a-4eb4-b7ca-b5b96d4c5098", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db9f243-0554-4779-b9a4-383ef84ff1ec", "sighting_of_ref": "indicator--a38d3c32-3c13-4335-ad67-b63384761e65", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36ba4b4a-184f-46ec-a9cb-40ecddc7c53c", "sighting_of_ref": "indicator--37e7a73c-66ec-4b74-8def-f355b9e3d418", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01463299-7859-4d8d-abc7-55d96aa226f2", "sighting_of_ref": "indicator--cd381faf-fc6a-4366-b5fc-7facacf2ed17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb81e52-e819-4856-bfda-5da058e2d955", "sighting_of_ref": "indicator--21454653-011d-4c9e-a2c4-65eac0f643bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63623118-0777-4d89-ac52-88f558319afb", "sighting_of_ref": "indicator--33756fb8-1076-4ec9-ac41-40a30eedcb49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a41a288-e8ae-4d72-9723-ad00a8f82b3a", "sighting_of_ref": "indicator--773f1c3f-22b4-4313-880a-ffb48fa674a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fa8f8ae-05a7-44dd-b298-6979490e06c2", "sighting_of_ref": "indicator--c3ed785a-7a21-4de0-9624-65b2dc477092", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a784902a-a31c-4dce-a669-a2d35914b87b", "sighting_of_ref": "indicator--3e77cf3a-9618-48e3-b043-fb2fc16a46a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a077b32-375f-46ce-b171-610c2f747020", "sighting_of_ref": "indicator--6fcc3ae9-067a-41af-91dc-28655da10750", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1340537-f864-42bd-b9ee-2697f9427ab5", "sighting_of_ref": "indicator--918847e9-7d9c-4fe4-9781-d3a34aa110d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef7ad75b-7c86-463f-b9f3-28bfd28ca4d4", "sighting_of_ref": "indicator--2ba102a8-f9ca-4080-ad66-142bdb0386b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e22bf4-4a4e-49c2-8647-bbecd13ab8c5", "sighting_of_ref": "indicator--a98ed1ef-18f6-4c46-bfea-a7e62b4b9cda", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--744d0d4c-f08e-4bec-a553-b6c0722394f7", "sighting_of_ref": "indicator--6f5622e4-496e-473c-aaae-a8afc94ae1dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b40860b3-a64c-4a33-8f62-56e934982988", "sighting_of_ref": "indicator--6469a33e-508c-4024-9ac3-643055039596", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a52661-d21a-484c-80c3-e511da65ec60", "sighting_of_ref": "indicator--a1073f97-eab2-47fd-99e7-abff31c7d604", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2aedaf7-7d65-4750-a83c-9b7e5e705ed3", "sighting_of_ref": "indicator--1139d31e-64d8-473e-835f-0d9db44cbfd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9c41cb4-2524-4d4b-a4bb-a120e2603514", "sighting_of_ref": "indicator--7a8d6a0d-2995-40b9-a8c4-ea16d8d2c2f5", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9404cb51-4631-4050-88d4-f79ef16e08e0", "sighting_of_ref": "indicator--3563c9a1-26f0-4d4d-ab83-72d0a0d5bf41", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92f374f9-ffaf-482d-ae96-3cd0448d0b2f", "sighting_of_ref": "indicator--51a2d2a6-b3e4-4fc4-ae0d-27148046abf0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60bbec05-8a4f-4f66-878d-fd7eec34bb2e", "sighting_of_ref": "indicator--e4ed43c5-72b3-45ef-8de0-42464269b3be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ca253f-b369-49c0-9b43-e973496af200", "sighting_of_ref": "indicator--6b36bb8f-0b4b-4a03-b77a-d3e8ec076b71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f9888c7-5f4f-4191-87af-af49f3f5ee36", "sighting_of_ref": "indicator--7cc06943-8ab9-4588-97c6-824cb5ab2660", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f32d095c-ca25-4185-89f8-c529efefbbee", "sighting_of_ref": "indicator--d321338d-9923-43d4-997e-f27ac38ddc46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f54a45-f9e0-42a8-bb13-620eab13baf3", "sighting_of_ref": "indicator--e6827b50-e254-42c4-8665-4873b8256d3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f87d39-5209-47ff-b779-fd702a6b5835", "sighting_of_ref": "indicator--6e2bc642-a16f-4ec6-870d-dd7d5d6c374e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbd24c39-dc96-426d-9107-84f70df052a3", "sighting_of_ref": "indicator--cb3a2efd-8cf0-476b-a2c3-a3a3509cabac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e685b673-433e-4515-b48a-b86088211713", "sighting_of_ref": "indicator--438d27da-5c1e-4669-a5c8-bac018111d36", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9e0b2ab-7e68-4bb3-bb31-bc421f101928", "sighting_of_ref": "indicator--5209bd7d-63ba-4623-b718-d7f71ba5f1f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b14e9682-da56-44cd-bf98-921a17a6f12d", "sighting_of_ref": "indicator--85971785-d9d7-465c-be7c-18c1d1ab4d7d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a07524c-8231-49d1-8dc7-52ff15ba52e3", "sighting_of_ref": "indicator--974d18f5-54d9-4c7b-9d02-7d56c45b2ae4", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--850064a8-f78b-45f4-b4d0-957d9fe3c874", "sighting_of_ref": "indicator--bebf19e2-7588-4cbf-86c4-89a47292af33", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baeb3242-1c5d-4111-9422-1b063119986f", "sighting_of_ref": "indicator--b812d059-f0ec-4504-9d24-3c552292ecbe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33bd2275-a138-4612-be34-9589c813ca6b", "sighting_of_ref": "indicator--a0988967-3b9e-4584-814b-90bff2c6b0e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c83d0e9-db57-4af1-8f0b-4c4eb78128dd", "sighting_of_ref": "indicator--cc78c0c9-9e63-467f-9c35-666bc2d52c85", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc9fbbb3-b370-4d41-8733-97860139bfa4", "sighting_of_ref": "indicator--720c53a5-450f-4e7c-8f24-98d6bb1de57c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae4d8ebf-ed7b-4bd3-9774-70dfa716d128", "sighting_of_ref": "indicator--4c4064ba-51c5-4576-b61b-95b252dcf613", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517c2e0a-9655-4299-8c6f-de60af969ebb", "sighting_of_ref": "indicator--587eb371-a7a2-4bd1-b3a7-1401c3c70e4f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--902bed47-9919-4fde-bef8-a8e39db86be6", "sighting_of_ref": "indicator--e9ab23b1-cc60-43c0-ad37-d219fe5d1c68", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c0ed88-27ea-4b20-8e7a-aa992f2ffe0c", "sighting_of_ref": "indicator--75335dda-ce07-4397-8916-26a2e4585043", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82e9498-8f78-4cb0-8df0-7b3b4b79d95d", "sighting_of_ref": "indicator--e3c9cd5e-aba6-4b66-8925-3c8e7237dcd5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c798003-2c1d-4aad-9cae-1bd5e51feeda", "sighting_of_ref": "indicator--e97c2bb5-b23d-40a9-9284-9e21e2c5e6a5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a4ec8be-afca-415d-9aae-d66941f8839b", "sighting_of_ref": "indicator--f463eded-c64c-4c45-b664-2500053d2587", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--864328cb-b730-4c04-9da8-7ad7725e0639", "sighting_of_ref": "indicator--79abb1a5-009e-486c-b7e6-970ffa12f7a8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfc053cf-5e09-4619-9310-fd45ddfbc370", "sighting_of_ref": "indicator--44bf5b61-d2d7-4f85-935a-0a222ea346ce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b3c3eb2-e51b-4a6a-81bf-045f16540e08", "sighting_of_ref": "indicator--d9671cd9-3bad-471f-80b9-88b4813fbe8e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8893d000-8014-46df-a6bc-e1d884f2ec9f", "sighting_of_ref": "indicator--2411e593-3574-4355-a874-d31cc1bbcb53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88cde399-e1e6-4c64-a5d8-b24810677b27", "sighting_of_ref": "indicator--7a45ebf5-f24f-43f5-8109-3e88fca9560b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a153eec1-982e-49fc-9a11-81515d5a8d3e", "sighting_of_ref": "indicator--26162a68-71d3-45f7-929e-af0bc01a1612", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec1e0bb9-1fe0-4f95-b604-de0ee5a072de", "sighting_of_ref": "indicator--cef63858-f372-4b5e-95a1-8a9ef33ee6e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32de4221-25f2-4bb1-ad44-6abe599029d9", "sighting_of_ref": "indicator--356b6914-bf00-415a-9b97-bce0f3b7c5a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb204df0-0a27-4839-ae54-51058852ca03", "sighting_of_ref": "indicator--e9e09c35-6f5d-4bc3-9cc3-5492730a5ef1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c0b3b6-9c06-4843-9dda-9ae27c2b0a79", "sighting_of_ref": "indicator--1435eb17-f329-4f47-a2c0-4db4356dc159", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb46a470-3954-46b4-9097-44521f8e2ffc", "sighting_of_ref": "indicator--4a172dc9-a4f0-4250-9b1e-cc5f2c2b3812", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33099697-c9ae-4f7b-85c8-0844e380fd82", "sighting_of_ref": "indicator--0c79e29e-92b0-4d7f-ab91-c9b5491d7e6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08256618-a7e6-4832-a43a-94ca06915495", "sighting_of_ref": "indicator--f3648383-0599-4bf5-97ff-a593bff72a25", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7b72de7-2598-485e-9e35-ce967e7a25c1", "sighting_of_ref": "indicator--bbec3ea7-8728-437a-9286-30b63cbd3565", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c5a84f-9c3b-4b04-9db0-493a8782d28c", "sighting_of_ref": "indicator--78bee9ce-8498-4bde-911f-7a594af21626", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e12107ac-0dc2-46df-960a-ab25fc2f8b08", "sighting_of_ref": "indicator--ff85f1d9-1d4f-4405-b92a-188da7bb76f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4a10b05-b978-44af-bbc3-e9be859a9cad", "sighting_of_ref": "indicator--459ca7b9-e149-49b8-87a5-dea179fa6684", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0ae73f3-ba01-4e0d-9a02-81ceff30a54d", "sighting_of_ref": "indicator--529bd348-1871-4a0c-822c-0b071f4588cb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c8c5009-4df8-48eb-b180-ce6ad6d9e1f4", "sighting_of_ref": "indicator--0abe33cc-8fda-4377-8bff-90363d8edcf7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d69997f6-34cb-42cb-8da0-0dea6158b1f0", "sighting_of_ref": "indicator--b82ab78f-a461-4ce6-86d3-1c00d433b4da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--709f6b9d-8581-47e4-9ca7-363a17206629", "sighting_of_ref": "indicator--54fd1f02-2c7f-4088-b1ee-f2ac2d800a1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d84487-13d7-4f5f-bad3-8057e14a2901", "sighting_of_ref": "indicator--f810949a-907f-4096-a3d8-4d5fa6ff2d71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2eb4a60-f733-4bd7-915d-5a8bf6884193", "sighting_of_ref": "indicator--5cc1e1ec-dc26-41bc-ab51-af3def42bb92", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8240d312-8fed-4055-ab00-281c6f74c46a", "sighting_of_ref": "indicator--56dc02cb-568d-458c-96ac-444696aa0f16", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f11012-8e9f-445b-b190-6bc3139033f9", "sighting_of_ref": "indicator--175777c7-7052-4174-ae31-5bf578cba592", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a025d948-a170-4ef3-83f0-fc918f39bca0", "sighting_of_ref": "indicator--3efec0cb-75aa-4a99-a883-d34af3d851bb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda2bed3-d712-4a56-871a-f5ca725b4a5e", "sighting_of_ref": "indicator--c3f1506a-1a1e-4e3c-8390-09b6563c17d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a17502da-9fbd-457e-a60c-647a7ecf3e74", "sighting_of_ref": "indicator--98f08acb-30b7-4ca1-bbcd-775f67b73842", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981a8f73-ad20-4a52-9767-8ad21990e047", "sighting_of_ref": "indicator--e844c7c2-838b-428f-b8a6-71c3a5cc803c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f24ece-1ff6-41ad-9335-fadd275163e2", "sighting_of_ref": "indicator--04967508-2d20-4d6f-9ed6-f23ee0546141", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e33593-203f-48ab-a260-0bcdd273bd30", "sighting_of_ref": "indicator--bd8fb835-b178-45be-9537-d7b9bc10753a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8ee8d1-fecd-4d78-83f2-c45d789cf56c", "sighting_of_ref": "indicator--5f763a47-6aa7-42e3-a3c0-633b8d39e86b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98512e6-ecc8-401b-829a-3ac27b5aa90e", "sighting_of_ref": "indicator--1ebd7f6b-25c1-4778-90f0-c69533166eec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb8199f-74ad-497d-85ce-75b24949ac24", "sighting_of_ref": "indicator--913e6aa6-2bef-461c-9022-3cd124c9e863", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--503c589f-5229-4752-bd76-4b6f3d2a58c3", "sighting_of_ref": "indicator--19cd0b51-a880-4195-accc-cded3cf12526", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b6a532d-0465-4ff4-8b5a-5d53b3baea1e", "sighting_of_ref": "indicator--19cd0b51-a880-4195-accc-cded3cf12526", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a12cd58-4ae5-4e32-81b7-b505bb6a2079", "sighting_of_ref": "indicator--9587b246-492e-4046-959d-5689c37a65e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--931537cb-bf8a-4cb1-b493-f57baa303be5", "sighting_of_ref": "indicator--e0e74cca-ea6d-41ea-8ac8-30c16e1c53ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7671c5f-401b-4617-af50-b5b1f82a4c3c", "sighting_of_ref": "indicator--6ca5b388-7a9b-4532-bf07-ace328bb0494", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--699ef585-54ef-47e6-bff2-3d1e4d66a5d8", "sighting_of_ref": "indicator--63aa37f9-5bec-4656-8141-a10e841b448d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a89a1e52-bf2b-41a7-a0e7-fbe4b32dd1dd", "sighting_of_ref": "indicator--a3734f7e-bee8-4286-9512-6035431d623e", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23a659bd-b508-46fa-a0a3-920611a67841", "sighting_of_ref": "indicator--7edaeef0-230c-43a3-b700-c3bd21ba8d1a", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cd52dc7-abc0-4842-a85a-3262c4ce6fbc", "sighting_of_ref": "indicator--23340f18-7190-436c-a839-9c60afc9d48e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68f10396-3b86-4cd8-a918-d0fd4697b779", "sighting_of_ref": "indicator--9d4e5298-f556-429c-9adc-f1550d182cdf", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82cd4c59-7ff8-4d49-95fb-85b229650601", "sighting_of_ref": "indicator--046448cf-459c-4c3f-8b79-377bef6a1560", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e790723c-88bb-4366-aa66-3d1dddb5bf82", "sighting_of_ref": "indicator--1054c7a4-cac0-4ba2-a554-557b505828ca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5baa9140-f7c7-4e30-966f-43512c078523", "sighting_of_ref": "indicator--0656a73a-8a13-4d40-b228-8cc6acf5181c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9033527e-fe3f-48c2-8b15-b07a689e8c6d", "sighting_of_ref": "indicator--59051ec5-08d1-4c7f-9797-00d50a6dacee", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--406f6bc3-753b-46e8-9834-a7e65af12aff", "sighting_of_ref": "indicator--93ce703c-91ee-4394-ae83-65b36bf43582", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2889db49-2c86-46b9-93f6-8cebbc0282ff", "sighting_of_ref": "indicator--68d2916a-8318-489b-8544-65218b049b26", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e06352cd-ba9e-44bc-8751-e1a31025a189", "sighting_of_ref": "indicator--a61f331d-906a-4d71-bf4f-f65deb39c986", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d0a431e-5c06-4b58-83d8-68eb1073deea", "sighting_of_ref": "indicator--71c5e70f-5bc7-4700-975b-4e4ada3dfd05", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b622fdf-61a5-4bf6-8ae6-0467f3abd02e", "sighting_of_ref": "indicator--e4406905-0ceb-49fe-ab06-375bcd6096f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdd9ff30-2724-4ff6-8520-25a2ebea7e85", "sighting_of_ref": "indicator--90511ed8-91b4-46af-9fa8-e287449ff7d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f89b07e-3171-4767-8eb4-4f6cde814731", "sighting_of_ref": "indicator--292745c4-b117-4ae4-b4aa-1fce65cc92de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f130b4-ecd7-4394-9c86-d467f13dfee8", "sighting_of_ref": "indicator--c3838ee5-65d4-483b-b1ca-0edd628d1b53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--270f5d56-2879-4b16-9d13-bceb188dd4e4", "sighting_of_ref": "indicator--bfb3b724-5641-4cfa-93f9-790665b29e06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abb992fc-cc5d-4b11-aced-3375e1209f7b", "sighting_of_ref": "indicator--abc3e690-1fa1-457a-b207-29be27c31e82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eefd46e-1248-430e-a21a-76656b97797f", "sighting_of_ref": "indicator--04036c1e-cc41-43e3-9b2f-06b35c40c7d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5d2795-d66e-433f-9514-4f3b1d7f7527", "sighting_of_ref": "indicator--18a72ba9-4b31-4c71-b06f-279f0c5c31d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a1c6276-bb67-4501-924a-39fd5b4e59e2", "sighting_of_ref": "indicator--9d789935-b365-41bf-a542-ac635f872af6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--984e09ac-e567-4bab-898b-d3a872aba47e", "sighting_of_ref": "indicator--1ab01201-ec1e-4aee-adfd-e0cb4339a70a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa42b70-021d-45cb-84eb-00ddb834e4aa", "sighting_of_ref": "indicator--5a2bb096-745d-4877-ac20-75679a750c0f", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e89b053-6af6-4197-b2a2-7a732529a39a", "sighting_of_ref": "indicator--82ba1f73-9861-48dc-8eb7-9fb3e4a81d57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3d97f1-5c27-4d7a-a747-51669bad4b12", "sighting_of_ref": "indicator--43487b05-d5f5-4a2a-9041-3dddb8e72bc1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105ab1ed-2cbf-4818-8174-49ece117519b", "sighting_of_ref": "indicator--c866480b-6427-4fec-898b-06bcd15accd5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b654492-ddc3-47ff-833b-55ac26ee380b", "sighting_of_ref": "indicator--ca619b15-fe0a-4cf6-bfab-4170cfb7c9ac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--638f79f0-d496-4bf4-a8d4-9eb6fa5d141d", "sighting_of_ref": "indicator--a60dbefa-ba45-475b-b3ac-53994943cdf6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--793f9975-55df-44d0-8e8a-cd81dfae211a", "sighting_of_ref": "indicator--c50b9d5d-6aa2-4153-8346-5a9a5891f5c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384cc27c-bdf4-458a-b67e-2b74a312bf3c", "sighting_of_ref": "indicator--71b103fd-c116-4cf8-9458-0098951fd093", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51e7bd11-c1d8-4944-bac3-7867fa22e3ce", "sighting_of_ref": "indicator--24c8b955-a9ad-452d-a51e-edbe7915e2de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f8858b-6900-4c23-8ad7-a76656d9b119", "sighting_of_ref": "indicator--08d40694-0036-4383-bf5f-838a8ddbc359", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6daa4ce5-0aeb-4b92-a5d3-014c84043fe2", "sighting_of_ref": "indicator--7fdd64ff-70ff-462d-b2ed-a453706c225f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--023ffc51-94e8-48bb-b30d-50821ea053b2", "sighting_of_ref": "indicator--6137d0e4-66f3-4fa6-8ffd-def2dcc40ec7", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0e1fce-f444-43f3-bdb8-08927929c9ac", "sighting_of_ref": "indicator--82ca1f34-f606-4f35-8100-4137c43a5cad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af7910e0-ca80-470f-83c1-2883d98798f1", "sighting_of_ref": "indicator--7038e10b-93a9-4899-aba3-e7f80c983d39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cccb385-f75f-4c8f-ab8b-cf7590dd8bd2", "sighting_of_ref": "indicator--0b606925-b2bc-4b7c-b986-89c721b0e4d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b44477e-ff03-4193-a9e9-4f12e9f5a4fe", "sighting_of_ref": "indicator--e010cea6-e866-46fb-9540-130219b59063", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3ab8d17-7937-4a59-ae55-f7dc88f20d74", "sighting_of_ref": "indicator--c010126f-ce02-48a6-a2ba-54b08652b094", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa28835-6bb9-440e-93b9-3a1fa2a297c2", "sighting_of_ref": "indicator--89a2c413-8ccf-4d18-8d0c-3a59bb217d3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8470dae5-5228-446e-82de-e9c82d6915a0", "sighting_of_ref": "indicator--a93da912-eaba-4b24-abf2-cb629f53d00d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e85bf61-2ba9-44b2-ac64-6e1faf504bc1", "sighting_of_ref": "indicator--7554480c-a283-45b2-ac34-9d7cfcefd54f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa516191-1278-4ba8-ae72-58fdce1cbada", "sighting_of_ref": "indicator--e2d39a42-aa73-4a87-b4a4-8a36a2600a56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--435e6244-11fb-457a-b8d3-6c5b680744ac", "sighting_of_ref": "indicator--f55b98e6-4cb3-4afa-abd3-d67e8eb6bfb2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6286cf3e-8b63-41df-a39d-3a02161ab9f4", "sighting_of_ref": "indicator--92a2b3d9-5e6f-4db0-a13e-7c084b62bf66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f9c5b4-9c89-4ab6-8496-8d9f86d308ae", "sighting_of_ref": "indicator--8b4817f7-8cb2-46c3-b3bf-8ef48f0f579b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90e80ad5-fffb-486c-9ef1-9631703a8f13", "sighting_of_ref": "indicator--f9b00cb7-8388-4c8c-bc43-960eaccca11f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b5abc1d-6559-43ee-9701-4d75169ff3f1", "sighting_of_ref": "indicator--09068c39-f3d4-4621-ba85-7d7a8ac9168d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d760f35-ed08-4429-82c9-e33284a58e07", "sighting_of_ref": "indicator--63208308-2638-4723-900a-4b21bb7d43cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ecd7cb-7881-4274-96ec-8236a3bee519", "sighting_of_ref": "indicator--c6b47e12-d5a7-4342-ae1b-2bd4fa3989dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--672a1a5c-27a7-49ff-a29f-bd2c6d1d034d", "sighting_of_ref": "indicator--993ceae4-d1e5-4847-a2d2-a9dc225f58cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12739548-e776-4e92-8f3a-3dcbd7c0143d", "sighting_of_ref": "indicator--a998a0a8-66f6-499b-89ae-82c23bba5a43", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca3da0fb-7ea6-42e1-9148-fe71c4d8d05a", "sighting_of_ref": "indicator--f6c4cdbc-ed35-4acb-9826-e2e4a75b0272", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5509e81f-44ec-4a66-8e34-1e405f1e4657", "sighting_of_ref": "indicator--ca38dc0f-c933-4c6a-9564-c9eac59ffad1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4037b0c1-c454-4931-a91d-53e7f70a8d8b", "sighting_of_ref": "indicator--44f2e2af-f05c-4d9a-8737-57c8b89f5676", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79790aed-47b0-4eee-8d93-eae56248d6cd", "sighting_of_ref": "indicator--d4e96071-ad9a-4554-be1e-8766ab26e85a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--339452df-469b-4fec-b211-89565ee8ab81", "sighting_of_ref": "indicator--226dc58a-afca-44e8-827d-f61ace165e94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d36c4db6-e51e-43fa-8a2e-47e3b23d35a7", "sighting_of_ref": "indicator--f045509d-9ff5-41d0-8279-c42d1902bf28", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c52761bb-1422-4f5c-9430-d71e7b36c110", "sighting_of_ref": "indicator--3ba09b7c-f6fd-4261-93c6-ba5038356da6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb24ef27-b79c-4e5e-a531-7fd78654c5b3", "sighting_of_ref": "indicator--ea07bc80-cce9-4d38-9d1a-1621a937e4a9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1555862a-dcd9-4441-92be-634a56fea55c", "sighting_of_ref": "indicator--71758599-6cac-4aee-92bc-bcadf36bdf05", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc6bb3b-d0c8-4b07-9af8-84ec6fa4116d", "sighting_of_ref": "indicator--addbd00f-694c-4b47-afe7-413ece0e8bd7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6cfde06-a44d-4f94-987c-98ca1e0b7882", "sighting_of_ref": "indicator--1cfec46c-b6ae-4fc5-a65f-28710f452a77", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6197a73-fd65-45e0-a9a6-829f5a9a1815", "sighting_of_ref": "indicator--749a1fd0-3280-4639-8c09-43e1caed1df7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab8415c5-6bbb-46a3-832e-c5385cda3a08", "sighting_of_ref": "indicator--8950d6dc-f413-4706-8700-c40086a310f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e5675e-7407-4f11-b10b-e1c56d7dc592", "sighting_of_ref": "indicator--f91d7db5-ff72-410a-b2b3-1193fedb7d6d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e0e0e99-b1af-4147-b99d-f3b98201cca5", "sighting_of_ref": "indicator--884c1fff-7f33-40b8-b82f-e2445ecd1081", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a41b5f35-357a-424f-aa16-850b2864e888", "sighting_of_ref": "indicator--8bb55635-6454-4428-9ec9-e6c6e9f6a557", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80ba3e4-075f-4f8e-b12c-b3a837b1acc5", "sighting_of_ref": "indicator--2a6673bd-cadc-4892-a242-7fd84316d5d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0822191-0514-4f69-afd7-4c6d5cad07c1", "sighting_of_ref": "indicator--12be65a8-cc56-4966-972d-54fb31453044", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75eaa55-cb11-44cb-ad07-9816a7853131", "sighting_of_ref": "indicator--1acbe701-faff-4a7d-9370-79d2c5f9ddd6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e29d19-85c5-4e1f-8dd1-65cfe59410c6", "sighting_of_ref": "indicator--8c5471c9-a153-46c8-9b9b-d074f7b079d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7825ca-7dc3-4ff0-be16-0a6bc7ef82ac", "sighting_of_ref": "indicator--fccee0b3-4176-4f79-98f2-2e1d43427d99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c6e4f1a-0a22-4491-806d-9a7cf857dd53", "sighting_of_ref": "indicator--597eee2f-e2af-4de9-b661-530ce078df80", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abf604f3-df6c-4ab9-9a12-8edc9d212c2b", "sighting_of_ref": "indicator--f81c9f92-73ac-4d76-8edf-964e1882dda6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--413bcf93-541c-4606-b691-1143732670eb", "sighting_of_ref": "indicator--62f2df3e-f253-458e-9756-43c3b569dca1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e7bed9-264b-4b18-8d5e-52ecb04c159d", "sighting_of_ref": "indicator--e77d99c4-a1d4-4576-a702-82ce647cf1b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02af8bc8-ca54-43ef-a0d1-bcb3ec62ceb4", "sighting_of_ref": "indicator--c50cf1cd-74c6-4283-8a0a-d1ee4dd0fd33", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76f2f61f-19ff-450c-b98d-64e1ec6201ae", "sighting_of_ref": "indicator--c8a9cd4b-af63-492c-b1d9-b549f45a478e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffb96ea0-2c66-487a-b298-768048a4a9d3", "sighting_of_ref": "indicator--732c7059-37a7-44a1-9325-736fabe89749", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2d72178-2202-4680-8f0d-dcadc13c475e", "sighting_of_ref": "indicator--ede21063-3c29-46c0-9d16-ef1b067cb306", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5f3d166-4d55-4578-8f60-a892df2760c5", "sighting_of_ref": "indicator--cce0c1ff-d5bf-4b69-8911-3da91648959c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fd04f5-0146-4fa7-a9c2-43a6880af86f", "sighting_of_ref": "indicator--3086a2c8-830f-4fe0-b3cf-96651009e7c0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23525cb7-8823-4b8b-b44d-e54c87abf04f", "sighting_of_ref": "indicator--160cde2b-ed91-4f89-bdb8-7963900686e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d2c9e3a-f164-4e73-9d07-9c8e8735293b", "sighting_of_ref": "indicator--87397f3e-1c1e-434a-b5e2-fd75e228b985", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2bb815f-947a-41f2-983e-700e41cf8dab", "sighting_of_ref": "indicator--e2066351-2976-491d-902c-6997b16170b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db18c211-a009-4e2a-ab6c-38e7017fc4b5", "sighting_of_ref": "indicator--392c9422-abdf-4095-b9c7-29d10bc9ecc9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d55cfb8c-be75-4ea5-8c18-bd6e8601d112", "sighting_of_ref": "indicator--430a15e3-dc39-4a15-9b28-f65d028ad41c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f515df7-d5a1-4981-8251-390bd9d06ddd", "sighting_of_ref": "indicator--3da85161-d919-44de-9da9-855283cf51f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--167b1c60-e9f1-4f15-93c9-4934c5afa0b2", "sighting_of_ref": "indicator--43be0b10-4f1d-446f-9446-c24f54113332", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f649749-56f8-4877-8fd1-88c963d35b12", "sighting_of_ref": "indicator--39fec5e5-758f-4096-a1b2-a6d7811ec9df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c75eb1-1cc0-41bc-b57c-49961ed234cc", "sighting_of_ref": "indicator--7fa11a95-e7f0-4c64-b243-7abfd215a0f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b8cc47-4802-4055-82fe-ef376f222ac6", "sighting_of_ref": "indicator--19d67595-813a-4fe9-97dc-0f29570d5a5d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8624baf9-ab17-4ee7-83ef-d916eede75f2", "sighting_of_ref": "indicator--d81832b1-dbf5-48b8-81ca-6d64d4dc01d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f4cf0a-b1d0-4d02-b7e0-87cea6bbbd00", "sighting_of_ref": "indicator--4512cacc-7cf3-4e7b-965f-3854b9fb56fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0f69b1-05c3-46c8-a4be-b36850d358f0", "sighting_of_ref": "indicator--538cf9cd-1a19-4241-a65b-617d81ae0d40", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b0859a7-e10b-43c0-a7b8-71e3dcdaccba", "sighting_of_ref": "indicator--6640fa72-fdc3-43f3-8cc7-c4331c0ece6a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--002132ab-c8bc-4c5e-ade0-20f3b2ed34ff", "sighting_of_ref": "indicator--a69c7b5d-42fe-4458-876c-c99184add94e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d70eba2-6df3-43f5-a12b-09e347bfbf20", "sighting_of_ref": "indicator--883c17fe-ebd3-41c5-8f76-aa8521529731", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb591fd2-72b0-4683-8c8b-94087d117365", "sighting_of_ref": "indicator--64fb4034-902f-4ec3-ae2e-f8f3c53c3d64", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0efef7a0-7cf7-49d2-9b10-db4e84d258cb", "sighting_of_ref": "indicator--0ce2a940-3e0e-4c3c-8933-4569f5a163db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c0c50a6-c1e1-44e4-81be-be74287d4521", "sighting_of_ref": "indicator--04859c6d-0e13-4c48-9d66-ebdcfda2a6ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86d0f79a-07f3-4365-be82-a2eeb6640355", "sighting_of_ref": "indicator--64fdf1b3-b139-42c5-860e-fb015c6524bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d7aaa67-fed5-4102-bce4-02f14184ce5f", "sighting_of_ref": "indicator--14015bf1-48e6-456b-b24c-e21473618706", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c4861c-fb92-4c87-bfe5-90cd5afdee59", "sighting_of_ref": "indicator--853ddbbf-a168-4c5d-8110-e1ef37178cac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3918abaf-f881-4704-9597-1fee8fa3593b", "sighting_of_ref": "indicator--9642754d-0f7b-49b6-8dd0-e6c4246afc40", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6ca8ce3-4d60-47cd-859a-c64295a2b0c9", "sighting_of_ref": "indicator--74130c0b-efa7-41a4-ab2b-0fbd5dcb7903", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8152380c-7413-4338-bd2e-8166d882ca83", "sighting_of_ref": "indicator--d0ce4c7c-af0d-4406-87a5-2f3ff52d8a94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7569db1e-9b14-4d93-b6be-4eea9c2cab02", "sighting_of_ref": "indicator--07725529-b1ed-47fc-bc00-4b41e1e4f1b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b71d6e6c-fc75-4d27-b427-3cba5ebf23ce", "sighting_of_ref": "indicator--3fb9c1b1-ffa7-4d2f-be5d-ec999b146c56", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0df1de1b-7d8a-42b6-9e7b-4558ce4a1e47", "sighting_of_ref": "indicator--a603cff6-0233-4f26-afaf-51af4cc5dc4b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2341b328-9736-4c29-ba8a-05b1cebc8c46", "sighting_of_ref": "indicator--239aa44e-0ff7-4428-8049-0c437144ddcc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26caa63c-f5c5-498f-b974-c5b0dff70e2f", "sighting_of_ref": "indicator--49368002-bd69-4763-8c4f-b81f4bfa2671", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b650e2e3-0f15-4ba1-b02b-b37b694f6f56", "sighting_of_ref": "indicator--996f25df-d027-4468-bc35-817c8e7efa5d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4649678f-954a-4acf-aeca-a54d33b68f60", "sighting_of_ref": "indicator--a7381aaf-234e-4340-b1c5-d522dc6a9dd1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0d7e212-b57e-4931-8478-9321e4650372", "sighting_of_ref": "indicator--a16f6b65-da80-4369-bf9b-5c5826663115", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1da16095-e580-4a1b-9748-ba0fea427ef7", "sighting_of_ref": "indicator--d14293fd-842d-4b9d-a155-ab3d1558676c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46d49159-eaf5-4aff-b412-975377caf4ab", "sighting_of_ref": "indicator--247df40f-6475-4b45-a934-2d2289cdb580", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--601ae919-8b93-4dc3-a2f5-da88d277cff9", "sighting_of_ref": "indicator--63b8eb2d-bae4-4c3e-ace9-85de795a272d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74a60c50-b311-47ff-926c-e28854aa7f0a", "sighting_of_ref": "indicator--9e26813f-a659-45d5-9913-5f0de66a56f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eacaf448-d5dc-4c7a-9394-9bfb2a5ca78f", "sighting_of_ref": "indicator--b225098a-57df-4e91-96fa-413b7e736137", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d80d6382-8a62-4c7a-90c7-c5865372f7de", "sighting_of_ref": "indicator--41abc79b-a010-466c-a092-9cd4803d5496", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647d7899-2c29-410e-91a8-335858747e17", "sighting_of_ref": "indicator--ed6cb406-1ade-428e-b67d-ee31b875ec93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcc7f5f7-a9f5-41e7-9d64-df2c75d46de3", "sighting_of_ref": "indicator--7b3aad64-724b-46b6-b321-bd4493e672d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad12fee-6397-42f4-80c5-e7932be2fee4", "sighting_of_ref": "indicator--c62bd858-d559-4ad3-a71f-ba70e709b9eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c37a96fc-62e9-4c13-a224-8a9babf2c5c5", "sighting_of_ref": "indicator--f279f191-0436-477d-8dc4-c6458942fc09", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11fa503e-8a2c-495c-8a04-dbed131e6f05", "sighting_of_ref": "indicator--a5f1f2fa-b53d-433e-b7e8-c6210a62cb5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f82afce-3bb1-486e-ac08-8c2659955622", "sighting_of_ref": "indicator--e9877ecb-b76f-4960-aea2-9ec17136367a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a07a785-1a3d-4ee6-8065-cf4016ff90bc", "sighting_of_ref": "indicator--87186dc9-69f5-42d7-83f8-299a8b6bdbf2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01fdc28b-ef19-4378-b657-d2b8ec4afa5a", "sighting_of_ref": "indicator--e5f4c642-a7f5-4c23-96a7-f6da5e7ff7e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdb4dbc8-4de7-4270-9b7f-2d04df5b8292", "sighting_of_ref": "indicator--7786ed93-6773-4a14-a2b8-c2d5ff0f038a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--697d2309-556f-44b4-9345-d02de7f00937", "sighting_of_ref": "indicator--782b3049-4bb9-4a53-923d-6b55fc1675c2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b17c79f0-f4dc-45cb-bfb0-35958d300d34", "sighting_of_ref": "indicator--2129390b-8879-41bc-9753-334f6ee150cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6034e6e-2404-46e0-8a69-eb6792f05a60", "sighting_of_ref": "indicator--73fca511-931e-4770-8818-17fbcf14c466", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f629f380-73d6-4422-8022-3ea67756fa0c", "sighting_of_ref": "indicator--a34749bf-456e-4ccb-98a9-be591a1f3f4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--773fad6a-6726-46db-8e06-70d67730ded4", "sighting_of_ref": "indicator--4f92773f-d75c-49f5-b775-de084beb6033", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df755aac-f846-4ce9-bc72-d83322523e60", "sighting_of_ref": "indicator--27c15cba-1b69-47d1-aabc-ba60a869b84c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94f3fe23-09a5-46c1-8893-c52eb023aa8d", "sighting_of_ref": "indicator--359bf9c6-8635-47de-9e4d-85cd7e778419", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--052ee2d3-d8a3-4dee-b720-22342bcc2e47", "sighting_of_ref": "indicator--3ece72ad-12fd-40d7-9dfa-53f7be5b4b40", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ca71c6b-2405-4912-a0ef-861b5117b71d", "sighting_of_ref": "indicator--cf8af3f9-e614-466e-9854-36c26d8684c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6595a964-73ce-4332-83ed-009156879618", "sighting_of_ref": "indicator--56d637aa-cdac-4b97-996c-1727716f87ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14cafc30-418e-4522-8328-cd9f81c1b5cd", "sighting_of_ref": "indicator--46dfda51-34ab-49b3-806a-ac26eb410bae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384547ec-298c-4e04-99b0-8e8df05e1aec", "sighting_of_ref": "indicator--a1951579-63ab-41ab-95ac-88f25f8f42be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d803c5cb-ac03-4e93-a5e8-6d2759d49177", "sighting_of_ref": "indicator--f7f813f8-64fb-4287-ad5a-c5dc4166eb49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6072694b-30b0-4533-b9f2-8dfaa8b52bb3", "sighting_of_ref": "indicator--cb69154c-2bba-4b92-9d9f-8a74672dc365", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70bed02f-4156-4784-b112-b7c50fae5ed3", "sighting_of_ref": "indicator--ca473c1f-a3b2-485f-b113-b47830cc9aa7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb51b4b4-bf26-4fe9-8d0e-02255b845cf5", "sighting_of_ref": "indicator--c930a163-a3e1-4521-be48-a59b0d33eacc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90852cd1-46a2-4724-a28e-43c266d39f78", "sighting_of_ref": "indicator--68584ab4-770d-472e-b55f-59dd4abc732b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89cb3032-50c5-436f-a4cc-baa5a1e193be", "sighting_of_ref": "indicator--4a6e44ff-7d59-4986-8731-37dd3655ff6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1066fc5-81c7-4fe3-a8e6-21998bafcea9", "sighting_of_ref": "indicator--ea7efe28-2290-479f-8465-ac723afe48d6", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a2912e-a33e-4803-952b-bcb34922baf3", "sighting_of_ref": "indicator--1ea519a6-f270-4a74-819b-85e113d24a0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79455147-3def-48e1-bcdc-6007e62e13aa", "sighting_of_ref": "indicator--d384ad35-e787-4271-a54c-feb20ff72b39", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41d8366a-5562-4ad4-907c-bd665df76e20", "sighting_of_ref": "indicator--4fb3cf6f-70cb-48c7-96b1-eff7fdb37d90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8cb7506-c537-426f-8fe5-705dc98fc802", "sighting_of_ref": "indicator--5e7e1257-8429-40f0-8611-83f4e46d7cd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b988575-cfd0-4c0d-950f-d5b6822dfdb8", "sighting_of_ref": "indicator--27b0316f-0285-4cb1-b1f1-6975076ad1bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d759ec-363a-46b2-ac8f-c5afcbb4b4e8", "sighting_of_ref": "indicator--dac28c61-36f5-4026-b395-1fd74f1c915d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1225e4-6cd8-403b-ba6a-354228ed0724", "sighting_of_ref": "indicator--84da3f9e-17ab-41d3-b6f1-d5d1a56e1fa7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92571ce7-9987-40df-af45-0435511c5797", "sighting_of_ref": "indicator--b448f76a-d2b7-4ab1-94f7-885627ed49cf", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a23ba5-3b67-4920-8084-a92ba78f0fd1", "sighting_of_ref": "indicator--7221bf0d-04fb-4b10-ba7a-dfae3df53d26", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ac2d0a-8791-4bb0-94ca-7eb5cbe378ed", "sighting_of_ref": "indicator--8a4db2c9-1d0b-43b7-b184-accd3b1f2ee6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8e49f8-ec7c-4461-ae89-c1defd5051dd", "sighting_of_ref": "indicator--65e2a70e-9d46-49f5-9823-01edd504767d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3b06da-4caa-45ba-bfe4-4d27cdc75e5a", "sighting_of_ref": "indicator--d92c9c3a-d73a-4473-81cb-a980bf0bf6df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fda79b7e-5320-4428-b05e-1d0fcfa75957", "sighting_of_ref": "indicator--7aa44bc7-04bc-4ccd-94cb-a78e607912b3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374cb345-228d-4c80-b0b9-973f83065427", "sighting_of_ref": "indicator--1df18879-5657-43cf-bab5-6efcd3ee5e42", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54f5325b-e611-4ba9-911b-063f62b3df07", "sighting_of_ref": "indicator--79c26ca8-17ec-4139-ba70-af009a16e532", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34a92bd7-02af-4c8e-a13b-ad82cdd9570c", "sighting_of_ref": "indicator--3c1ab13f-4952-4f0c-b54b-0d02b4d6a0bd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b9ee1a1-8f73-4cfa-83ce-c0d71975bd9a", "sighting_of_ref": "indicator--e92d01c7-52db-4cb0-8d2b-a08db399364a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ae57f8-8435-44ef-9ca6-ff3174e66e3f", "sighting_of_ref": "indicator--6d8cf6ba-8ffb-4bc4-b399-7dc4abadbf4c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d00461cf-e80a-442e-8d33-5caf83982cdf", "sighting_of_ref": "indicator--6d8cf6ba-8ffb-4bc4-b399-7dc4abadbf4c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--881a5f89-a9a1-4887-91e2-e9d26134a2ee", "sighting_of_ref": "indicator--cbd8a220-beab-40dc-8975-c6531eab8289", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e989cf3-f411-4890-a821-71b168622fc2", "sighting_of_ref": "indicator--62d6cfc1-0ed1-481a-a900-1cd986ee3c7b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a711c772-cb7b-46ab-87e0-ba07151808c3", "sighting_of_ref": "indicator--298a3575-595c-4edb-b2ff-e7f5e81bace7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04ed3aec-deec-4295-857f-ad6fc1b36ccf", "sighting_of_ref": "indicator--fcca383f-cb0d-41cc-9568-cf276a1146a4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f3d9b5f-853b-4314-ad5e-86c7f2f16227", "sighting_of_ref": "indicator--fcb51111-3b16-47ee-8e7c-d9bdaeb39ab2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64f5d264-3811-420c-b1d0-afbed3b29d6c", "sighting_of_ref": "indicator--149d3261-1ab1-4787-b22b-a4655905576f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--799ce60c-28fe-47e7-91bf-603bd33e6ca8", "sighting_of_ref": "indicator--204be8cc-03c9-4aea-898f-022076eaad1e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--445b14f7-b329-4f80-82c9-729c8c5a6182", "sighting_of_ref": "indicator--92c1d09a-bb83-4ba9-9f10-1ae7a4b2b39d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81651e0e-3c4c-4e25-b080-6cb6ae6d0a7f", "sighting_of_ref": "indicator--e223fade-5437-44dd-8062-27dfb91a5c57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e2fd91-7988-4928-9e7f-0c8c2e9d63ea", "sighting_of_ref": "indicator--17ec2fd1-d537-4e07-bb6e-547a8b26fc78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d4bcfee-1ac0-48cd-b090-1f3a1bbf28d9", "sighting_of_ref": "indicator--8a485ac1-f1cd-417e-a4b2-e40f32bac010", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e091d2-9cc5-4761-895f-ceaebc901b09", "sighting_of_ref": "indicator--58b36f8d-0207-4d36-a4be-bc25bdb7506a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebb72d26-7c2d-401e-8c51-3795a00b6c3f", "sighting_of_ref": "indicator--4756f5d4-7a18-4ac1-b5e6-0ef4861092ac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--678c0c7e-4894-4323-b049-386a3f95eda7", "sighting_of_ref": "indicator--cdd56330-c6f2-48bc-a8be-af062f01ffd9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8d9cdc8-2903-4e5a-9fd7-2a9d6ec3ec85", "sighting_of_ref": "indicator--94ab4250-79d0-4658-9daa-0fc4eb0a2b06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a98a5152-0593-4a68-8085-814013d21289", "sighting_of_ref": "indicator--dd6f1b3d-af7f-4d6a-893d-075e0c8d4882", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--619963f4-437d-4bea-b5fe-b409156c5f85", "sighting_of_ref": "indicator--198c9c90-d87a-4b29-a59b-67ad7272323c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d34c59ca-866a-4a06-8473-a5968715936d", "sighting_of_ref": "indicator--aee7f442-d974-43b8-9ad5-f1f4573f64b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87fe4b31-ca35-4f5e-a21b-7205ccd582c2", "sighting_of_ref": "indicator--15ca5c6d-e631-46c6-80a7-1d793527bbb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac93de02-8ea3-4926-acf7-47b0d01ca52b", "sighting_of_ref": "indicator--d469102d-aaac-456d-bb44-c5c09f14b06d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e01808c-b9ef-4e7e-9712-175ef2bc8cf7", "sighting_of_ref": "indicator--a2621ce7-cf3e-4db2-a9bf-61ed69249a57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5bc2ab-b968-4335-a573-9ac141c8c9ac", "sighting_of_ref": "indicator--bc764b89-9573-4252-958e-b57925e10985", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7281d3-6e41-4e4e-9a8b-9ead55b061a1", "sighting_of_ref": "indicator--c70647d1-8fb9-43b5-a0b3-df55dfb1f575", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d173135-646c-4030-93ee-4020bd4add46", "sighting_of_ref": "indicator--da8b7673-132b-4b8a-a704-a30d48785a14", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf4ac54f-04cb-44ae-bbed-735036148d4b", "sighting_of_ref": "indicator--acdde07c-0293-439d-a7ed-e6ee301e9f17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d741ae3-7238-4b9d-bf5b-17ccd56faf87", "sighting_of_ref": "indicator--2a398683-37bd-41c1-ac0a-7781e57dd80a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--251d406e-bbb6-41dc-a317-14ac8a3ee797", "sighting_of_ref": "indicator--eb06e747-0895-445f-9b66-d048cc06028f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c1308d-f949-4396-817e-3f9cc1ea223b", "sighting_of_ref": "indicator--2e9a4ca6-102e-4d8f-a2d4-ccdef03e806b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d1762a3-f223-46e6-9031-4b2c07caa039", "sighting_of_ref": "indicator--b809bf28-4a30-4d2b-95be-1d8829597e87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2fc28b-96d1-4f31-a218-df3050590dcd", "sighting_of_ref": "indicator--7fe34e44-ef0c-4f75-bafc-31a9229db031", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28069938-5dff-4935-8707-9640b6fdbd78", "sighting_of_ref": "indicator--b131e142-1cd3-4441-8364-239b01c2182e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4654767-565a-4669-bd57-e63ff6b234a9", "sighting_of_ref": "indicator--10e4a388-8454-4ab5-94df-c1cc24339160", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cacd0e06-82d1-4e2a-a7bd-a37ab2cea1a3", "sighting_of_ref": "indicator--8c2f09df-de8b-4480-8dc3-aa6f28219b93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d897e07b-3a30-42be-af79-ed2d8e924fd6", "sighting_of_ref": "indicator--e32d51d7-082d-4476-9f53-1af2748e1f20", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86a153a-0031-4fd1-9c42-7fffed37a704", "sighting_of_ref": "indicator--103617ba-b29a-4078-a159-23083d833cbb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--303e32d9-04aa-4157-98ac-62c6d2da0618", "sighting_of_ref": "indicator--19b9fc1d-a0b8-4653-bf5c-b516062cfe74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5943cea1-82a6-4749-a1e4-bba881aeaa83", "sighting_of_ref": "indicator--6d47dcc7-9177-491d-9f8d-8e0018362a04", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b01e3aa-14db-4fca-bb39-918d62c9ce6c", "sighting_of_ref": "indicator--2ee04af6-70de-4478-9bc1-c83ad7d1f65b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--502bb370-f8a8-4c27-bd6d-99aaa888e630", "sighting_of_ref": "indicator--2ee04af6-70de-4478-9bc1-c83ad7d1f65b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08744466-bb25-4755-b99e-c6310cc55677", "sighting_of_ref": "indicator--f940a8e8-a4a3-4356-8115-3d7a7250f0fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd08f409-79aa-4e86-9580-f31e0c0ce558", "sighting_of_ref": "indicator--444c6ef6-ada7-4bbd-811c-0dea3923769f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--471ecca0-4fe3-45e6-bddc-f3d47ae13eec", "sighting_of_ref": "indicator--e2fa0cd0-e1e8-4277-80ce-d5ae6416f73e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb1a01b3-1bc7-4b71-8acb-34f5636db36c", "sighting_of_ref": "indicator--8853f50e-8ca3-4a39-aab3-2248a5f76ce0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed79a9cf-77ea-4792-8c55-9124be13266e", "sighting_of_ref": "indicator--39a2334f-24d8-4bed-be8f-3d64045c109d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f6136c-c943-496f-8576-55feb03ecd71", "sighting_of_ref": "indicator--6b5e230f-8e46-4704-adb3-17a1d31ec6b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4861e9e-afa5-4bce-8ad1-6afb50bed957", "sighting_of_ref": "indicator--674fd10c-ff21-496d-8634-39e8df1494c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--887ff21a-2131-4205-aea7-1ccf0fe4133f", "sighting_of_ref": "indicator--a1596a80-ab1e-4ab4-974e-3790dbb10e06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79537b7d-2308-4683-8e25-7b8fdb25704b", "sighting_of_ref": "indicator--e7dc61e1-8172-422d-9dc8-bc3da2103c6f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f899680-bae0-4af7-a024-faa0b0da1f23", "sighting_of_ref": "indicator--90b2ba3d-096a-4ee6-a39a-09b3001c9022", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca3ee05-84ee-4820-abc6-f291df90612e", "sighting_of_ref": "indicator--c1c6f2b4-3858-4080-a110-73a119199ee7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--695daba4-9b71-4cb9-992c-6456452fc97d", "sighting_of_ref": "indicator--8b993189-276a-4576-8d9e-b0b54574dd9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fab2775-fdc3-438f-9857-4deab9367fa5", "sighting_of_ref": "indicator--28a6cb8d-d686-4c7d-9080-0beaa77ac9eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--474c7c0f-f7dd-4877-9210-ddeec74bdefd", "sighting_of_ref": "indicator--0736127c-b03e-4168-9934-30ddc36a7c2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d95e41-504f-472e-8371-e0c2b53ae9b2", "sighting_of_ref": "indicator--3eed5a22-f522-4113-8d26-c1a6b51fa2f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ae18291-9e4a-4142-91eb-6f9ff0c73fdf", "sighting_of_ref": "indicator--7d1fa683-27fd-4c65-8c6b-bc6b070b6484", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4294ad-c203-4cdc-bea2-765772a243fa", "sighting_of_ref": "indicator--6d9f7fb9-57ce-40c6-bf58-afb33305a86b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec25af9-e24a-47db-a814-2078b6db055c", "sighting_of_ref": "indicator--13aef32b-8e2d-453d-8c46-1d4a9cf4041f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11b0d6e4-7b66-483b-9ccb-0e470cb19c9a", "sighting_of_ref": "indicator--2d0c6206-ff85-4095-b633-99467fd6e584", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1057c1b7-ccfe-41e0-8553-ea308b95101f", "sighting_of_ref": "indicator--b2beeead-a187-4a86-a212-1ae7c5653698", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79915f6f-30d8-4a1a-9746-e01e3681d178", "sighting_of_ref": "indicator--aadbbd50-d12f-4daa-9028-d2a1d1698da1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c0ee3d-ee7b-406b-a5a0-236db7ff2e6a", "sighting_of_ref": "indicator--99fd6363-3bd4-49c0-83c9-18592ef82e37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dad4cdc5-da2d-4d93-8b3f-b6119aa2e5f6", "sighting_of_ref": "indicator--5326ac5a-4434-4e4b-93d1-0c09615d98d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--135c0ed1-668b-4d6e-b427-b739b883e416", "sighting_of_ref": "indicator--bf2dd2d0-1826-43f8-83aa-94590617d1ba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--291b5938-ef5c-4db5-bba3-07e763e5d561", "sighting_of_ref": "indicator--096ed643-4919-45e8-961a-85fb1a9dc5b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dab078c-18ee-403e-9d31-184374a59afb", "sighting_of_ref": "indicator--803f4386-9e47-48bc-a966-d53640e2c847", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2412c02f-0e22-42a5-935a-ac032a6f7bb6", "sighting_of_ref": "indicator--eeead983-28a4-473a-bb58-2f1a445e8b70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5868de6-7a40-4871-851b-7d7bb2d66754", "sighting_of_ref": "indicator--d6e8ffb3-197c-4133-a05a-dc6995f47c47", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e939840a-2d2f-42ff-899f-1e00b3f55dff", "sighting_of_ref": "indicator--5022fe82-b9a2-49e0-8983-9d9db072d54d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4fd60d9-1f8b-48a8-a488-e5e85c6bc587", "sighting_of_ref": "indicator--5ecb9faa-fa51-42b9-9388-49831fc17208", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bde84a93-7d5d-43a2-888c-84303d97497a", "sighting_of_ref": "indicator--5c24544f-8d5f-444d-a7db-c384614c02ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6a7c1d-e0a1-4a42-9a88-ae6bf90c7a20", "sighting_of_ref": "indicator--c902c0ac-7823-4a63-9fb7-75222eb8b749", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66d47c39-602b-413e-8ea8-fb49d09eac4a", "sighting_of_ref": "indicator--18f902e0-d792-4038-af5c-336d586b281f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3748a45c-a1ad-4339-91dd-c268498d4fc8", "sighting_of_ref": "indicator--19a3eba7-8ed0-4e9a-adab-1e77cb1668c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d7ca4d5-808e-45f2-b974-9a767251b167", "sighting_of_ref": "indicator--d65080f8-fcfd-4309-b9c7-78ec9ab1e60e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a7ccbeb-684e-47c0-aa7f-489d5ed4827b", "sighting_of_ref": "indicator--705b658f-a89f-4b9e-82c3-fdec716deac6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad96fb40-ab7c-4b92-b579-836ccd33e89c", "sighting_of_ref": "indicator--95551685-8fd2-4a65-b49b-37063a1b1226", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72adc060-6e35-4d71-96f4-33dd4899ccda", "sighting_of_ref": "indicator--f1fdd565-208a-44cb-8c4d-f1631c9714e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2fe69b1-b66e-4203-a04e-bcdb9d9bef2a", "sighting_of_ref": "indicator--02b2a084-f496-4a50-b5ae-f8f4038a7724", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae95c1ff-8b8b-44c8-8a1b-4d42f29cd31c", "sighting_of_ref": "indicator--c02dcbf8-789f-4eb4-a7b2-0e95829a312d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdaa6140-6683-49eb-8434-3220dc3bfa1c", "sighting_of_ref": "indicator--3500be8b-0d38-4c51-a4be-a03fdecb5872", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e6153e8-cca7-40cc-b472-ba1035cbefc4", "sighting_of_ref": "indicator--380282b0-99d9-48ee-8d5b-c7652f3cd227", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73934493-ef2c-4074-89bd-3e770fbaea86", "sighting_of_ref": "indicator--f429b012-bacb-487c-a9f6-2e92dd09c858", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3e976d9-229c-4457-a86a-b1f973c7ff9c", "sighting_of_ref": "indicator--dd67ce49-2679-42ac-8c4f-25299fd18983", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e21a9918-24c8-40fa-bad6-60badc27d0cf", "sighting_of_ref": "indicator--102e6b3f-2f86-4723-bfa9-09fb52442986", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef4b53c6-5d45-4248-bb38-6b30e988b172", "sighting_of_ref": "indicator--dc46ee85-2e46-4d49-af79-5e34e5f31d0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f5f72e8-1df5-4e29-9840-7a323a713afd", "sighting_of_ref": "indicator--f1ec07f8-b0b7-431b-af1b-5d06d80f9383", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd71785b-13af-40fa-bc45-f013930640b8", "sighting_of_ref": "indicator--db171d64-3a1b-413a-8d10-02c9504bcac9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aa6c948-124a-4958-b248-15035e7bae77", "sighting_of_ref": "indicator--6577c7a0-a7a5-4646-b630-f44be6a94ac9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c8067cc-218a-43fd-816a-417ae66a6526", "sighting_of_ref": "indicator--e90fcbd4-e07b-4830-ae20-51b5c7776580", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1fd1f58-eaf2-4f2a-805d-13d9b9e43f11", "sighting_of_ref": "indicator--1f710e01-3193-46d4-9b02-32174cc270ca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38bb9dc1-feba-4152-bfa8-c9862f322292", "sighting_of_ref": "indicator--beea47a9-4940-449e-a4e2-24b417037804", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--916b054e-f48e-4fa1-9d4d-c28ea779a22f", "sighting_of_ref": "indicator--5b7cc6e6-bfa1-4c4d-bfc3-6a0884a0c6d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87a678e6-d9aa-4948-994a-710dc99246ec", "sighting_of_ref": "indicator--2030e076-7d6a-45f2-9571-1af2b85af244", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4622f3b4-55be-46a7-96c0-6d85e84bdf25", "sighting_of_ref": "indicator--4fd1063f-3676-40e2-9671-cfbe58135e8d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f26240c-8436-4847-91db-32519fbd86cb", "sighting_of_ref": "indicator--f5d96a3f-d201-4d2e-8452-fa211b60be72", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff933dc-02f6-429e-9bbd-c7612ff1529c", "sighting_of_ref": "indicator--6db9f20c-4d7f-47fb-aae7-133501defef0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e8d151a-c9c0-436d-9737-adbdffbcd77d", "sighting_of_ref": "indicator--09718f95-512e-4f11-b28e-33a7d60a90d2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baa4842e-b142-4bb1-88a3-cf13e70e0e29", "sighting_of_ref": "indicator--c17e1ead-d23f-48a1-a486-ac3cb8f613e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bea428e-b97f-4497-a81d-3a969f0c7547", "sighting_of_ref": "indicator--9571f6a3-4769-4d7d-b325-00c000ac53dc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--351ffd24-2795-48f6-b223-b5ae6f29ed6c", "sighting_of_ref": "indicator--afb025fd-e8ef-4998-b18b-5f58e1163698", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c283de-00a0-4c97-bccc-ace2f4180ec8", "sighting_of_ref": "indicator--7893b5e5-82ed-4c36-a86b-2bb6d4a90531", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc64ead-eb70-4201-869e-a7ef256730e4", "sighting_of_ref": "indicator--aaab6dd3-4b11-44d9-b738-48e459bbee70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4914e690-bc44-48ae-9155-9d1564c59558", "sighting_of_ref": "indicator--cf6891d5-842c-4f2f-8840-92803349f59e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f843b52e-0d5a-45d0-a750-ca8b6fcf3804", "sighting_of_ref": "indicator--1e915161-4b98-4c18-9c3e-58128d2ae7da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2172da74-0e7c-4691-a807-f28e9cb13faa", "sighting_of_ref": "indicator--473a2205-9cbd-49b8-b2f7-f8442111b7ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90285798-43d8-4f6e-9012-1a149fd17540", "sighting_of_ref": "indicator--9c590188-cdc7-4d5c-8722-708667844dd0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04dd029e-8cd6-494b-9210-406f4e70f380", "sighting_of_ref": "indicator--8991e880-5d4e-45f9-ac6b-37220ece0e16", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f2d657d-755c-4727-91b4-20d546ba6451", "sighting_of_ref": "indicator--e99ead2a-8a14-48cb-8e3c-bba38a86039a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08681802-c82e-489b-b519-2002147e2e10", "sighting_of_ref": "indicator--39dda6bd-a233-4058-9abb-b0b479367558", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b6cfdc5-2209-4bb1-96c7-e8f479516635", "sighting_of_ref": "indicator--f757dc22-1ba8-4769-b896-20ff4b545046", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aae1f235-a31c-4ae1-9209-33970c11d96c", "sighting_of_ref": "indicator--cdbf48e6-4e43-4272-b009-67a9fc9039f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10e06a6f-e94a-4132-9ae8-a3f14e1c6018", "sighting_of_ref": "indicator--e7bcbd7d-6250-4997-bc4f-e325f858e59d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--735800be-7f47-4cfe-a06c-77f420cbf18c", "sighting_of_ref": "indicator--fcd1a7d7-22fe-4b7d-82c3-f6a85b8bcf49", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a5c83d-eb87-4440-aca4-6f14c0986b0a", "sighting_of_ref": "indicator--9d8c0271-5f1e-4399-a1f0-e5b1340b087e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41fbf1c0-e889-46ae-bf8b-b84dd0477364", "sighting_of_ref": "indicator--43d96630-016e-4ee3-bec9-3a0179d86f2e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25fc31dc-a546-4878-a824-093d7f0191b7", "sighting_of_ref": "indicator--131c054f-d4fd-4c8d-b773-f1955c3cc7ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcbb6fa9-e47c-4581-9003-edecc52d864b", "sighting_of_ref": "indicator--69879ba1-9c46-4611-92ee-1d05a2f8b196", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46802cbf-fad5-4937-b260-54c485dfa182", "sighting_of_ref": "indicator--16715a11-6698-4e7f-b938-7471720c6c53", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--853471ea-7833-45fc-8189-e7eca6d47a13", "sighting_of_ref": "indicator--835394b8-9c16-4fc2-bdf7-2e605a550138", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ee4ff4f-c7df-4eb4-8b2f-0a2380c3dc10", "sighting_of_ref": "indicator--465fc953-d42f-44ec-98f3-cf03d4d1095b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e490af97-14e9-4059-bd9e-1ca902e75663", "sighting_of_ref": "indicator--626d0720-bddf-481d-bb58-a412ee0bda0f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07f32817-df96-4eca-8c45-282bdec92aea", "sighting_of_ref": "indicator--7f7e0cf6-0a61-4af9-987c-73f3204ebb58", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed5ab11d-5f44-415d-8188-abf0085d62d2", "sighting_of_ref": "indicator--4e77a49a-a543-4906-9b59-ae4212f90a4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fd5257e-8ead-4d27-a468-d7e2c700a2de", "sighting_of_ref": "indicator--b6d45850-450e-4f33-8a88-ca16bd50a608", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80206c14-cb67-4dcc-9050-ed883cfdb57e", "sighting_of_ref": "indicator--1c81a364-aeb4-4d8e-b4dd-80cbc2075c1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--825ba854-1eac-4895-b2a9-9893bc663a69", "sighting_of_ref": "indicator--ace82091-c0ed-470b-9a33-aa8991d5f33f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c68fdb5-d961-4bb0-a4b1-663250f7cada", "sighting_of_ref": "indicator--4e2843c4-76a8-465c-8cf7-eb9accc5e712", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a53d4d8-db04-4fcc-a4d1-462b787685b9", "sighting_of_ref": "indicator--55c0369c-f37b-495c-aa0a-30f3259debfe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4a030a-0329-48b9-9ee2-75cc8509ae2a", "sighting_of_ref": "indicator--ecc5b062-6b55-427d-9668-a3d7689f2fdd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc52414-16e6-4304-85d3-1de53cd3f5f7", "sighting_of_ref": "indicator--30a031a4-8d8c-40c5-84f4-97624d02c47d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee98e8b7-67fe-40fa-8b48-3c958d202d33", "sighting_of_ref": "indicator--4ca7af8a-0119-4f77-8799-db2d1ae2a7f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c08eeec7-03c5-4de4-87ea-bfcac31ad34c", "sighting_of_ref": "indicator--4d6ba5e3-9904-476e-9126-abd5f4b9739d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e48154-cbed-4598-82f0-9b7ce7fd3520", "sighting_of_ref": "indicator--f5af15b1-075a-4235-84fb-cf8719030f07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77cfd271-4ae9-4f6c-8a22-33f5aca19b15", "sighting_of_ref": "indicator--8c9c0df7-8f92-4a90-91b1-a3def9d06bd9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c0373a5-d085-4c20-b83b-8a0eaf194a84", "sighting_of_ref": "indicator--306965bc-d67a-488c-b24c-65df55b68c7b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33d4a110-b055-46ec-9e96-29a12619dfe9", "sighting_of_ref": "indicator--01a19326-8139-417e-a35e-06dfe91a4356", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c596551-2bce-4b04-bf01-62055a0c222f", "sighting_of_ref": "indicator--a11124df-9178-4f48-91c5-d5b809181e83", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbcae85f-44b0-41de-9226-18a063f569dc", "sighting_of_ref": "indicator--3424447d-0b58-42ce-a3d8-88b6f3b77290", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b06cb84-2f0c-44ed-b196-5d2481c72dca", "sighting_of_ref": "indicator--e240009f-30fa-4b77-9b2f-ef1a0e81a4f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe0acef-630c-4c24-abec-5b376577adc8", "sighting_of_ref": "indicator--4d456880-2014-4731-a8a7-8142a8271b7e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92b0b9b-da2a-4a12-b738-1ae6ae0f235e", "sighting_of_ref": "indicator--9b1ccf8b-87ea-4e74-8527-bb728e3be0e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81105ecd-a3c1-4fc2-82f0-c86e95770c4a", "sighting_of_ref": "indicator--7f9b2a7f-d0f9-4718-a72e-beaae75c7c11", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e235cd97-44ec-464b-bc45-967bcc258678", "sighting_of_ref": "indicator--915847a2-8e20-4796-a42e-3aa08ebd8d04", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c97b981b-b35d-420e-b3af-2b2f356bbebc", "sighting_of_ref": "indicator--70f85517-2383-4ace-9589-a1622e514816", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8eca728-0925-4760-914c-65ac9cbbc03f", "sighting_of_ref": "indicator--56b381b5-7e69-43fd-be92-773d850046d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d06b9f0-9bcd-4f30-9fde-5d7e0e7e0dfd", "sighting_of_ref": "indicator--6adbea04-6a99-457a-acd1-bfeee1235b4f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5380abd0-a484-422c-9481-451b9fddce95", "sighting_of_ref": "indicator--9922c363-a755-469f-8f20-8a682fe8dc3f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d7eeb3-953d-4e68-8a0c-74aecfe1b101", "sighting_of_ref": "indicator--b1048f1c-9556-4ac6-92c5-1b298ef208ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bf4fe0e-b894-49c5-b3a9-94d73ed051f5", "sighting_of_ref": "indicator--bc2df9bc-f2f7-4d86-bf19-bfdf52bc3b60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e50626e4-a73b-473c-a991-a372f510a7ff", "sighting_of_ref": "indicator--7f6b8889-140d-4ea7-92a4-0b505ba6df2c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8f530c9-d926-4752-97f6-66623eb2ec01", "sighting_of_ref": "indicator--012696f1-e030-4277-a64d-326f9cc5e6c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a33fe497-6ff1-46a4-86e9-c26c8b8ddda8", "sighting_of_ref": "indicator--d507f1e0-9c60-4c9c-8afb-6aa58d5e38c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7838a701-6705-427b-a0f6-3ff9b91fa953", "sighting_of_ref": "indicator--b64440f8-a9e0-4e97-85b0-47541a232038", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--431af51e-940a-4afb-bc4a-ad80bc52aa03", "sighting_of_ref": "indicator--8d6c9aff-fc87-491a-83a6-7a9da06c6f15", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92f1612d-e454-472e-8f02-d85f70c3179e", "sighting_of_ref": "indicator--d482fe5b-7b43-4c39-a51d-45b005427124", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15047c6-0aaf-4b8d-a2ad-2b6bad0074e1", "sighting_of_ref": "indicator--dda4e13b-b7e3-4f44-8233-ee0cf78dd504", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc842c90-244c-4fd9-bf43-2c5fd2904fba", "sighting_of_ref": "indicator--cad0b5e4-cc83-443a-b682-9d8c0334a1b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--165faa8d-71e5-47e5-aad3-a69945e246f8", "sighting_of_ref": "indicator--4832d185-c9fc-407b-bf91-1042c93b60ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae5df633-b666-40b1-9937-917d748a56c2", "sighting_of_ref": "indicator--6cd110df-435a-4800-aaac-53faf275b652", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7da3d767-8a0d-4eea-9f20-0ba8015c42a6", "sighting_of_ref": "indicator--f76a5b1d-5ba7-4ec4-a7cb-774fa48ed84e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--711572c5-6dc9-4b7b-bedc-50d3f1e5c61a", "sighting_of_ref": "indicator--ca310baa-ea65-476a-a1d6-b236a2eec8de", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac049949-7f59-4c11-bdef-f53486ab4ebc", "sighting_of_ref": "indicator--aae393df-d61d-431e-bddf-649f0d35ced8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cddb8e86-8a07-4512-b5bc-4874fdde3802", "sighting_of_ref": "indicator--f4bc069c-9d8b-47c8-b9d5-ce5485cfe3db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1322f2d-6b4c-4d47-b668-b00e1ae29531", "sighting_of_ref": "indicator--1e5f1ee1-07ab-4cd6-9c85-e2601e50d895", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d4d4b2-bd8d-4b27-a933-1a9012ba16b7", "sighting_of_ref": "indicator--73ba12a6-2c50-49ec-bbad-82d0bd33430a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19bc62a2-cd89-411e-a93a-58e8108315bd", "sighting_of_ref": "indicator--ee6b7c1a-4160-4e8c-bd4d-8454834976f2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--661778ea-c73d-4dcc-abc1-2567b6a05c4c", "sighting_of_ref": "indicator--77504325-c6b0-4ac1-845e-a907532e1d48", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e421b7eb-302d-4c07-bb52-b3956ceece04", "sighting_of_ref": "indicator--b9a120ca-0253-4201-9ae2-a6d00be0ac23", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfbd0973-1c45-480c-8c5d-a3771eecb060", "sighting_of_ref": "indicator--fe41dea5-f80d-4507-b5f6-bdba41a64e37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6be6ef8-e0b7-470d-a873-e53f62aed624", "sighting_of_ref": "indicator--1c074061-8d6e-4317-b44b-6c4add56a58f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84486078-b3c2-4a4c-8e32-47c2c7c59c04", "sighting_of_ref": "indicator--b055b2d5-24c8-4dbe-adf4-495aa33255ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913c87d4-6a00-482b-880b-2a3c7640b7c1", "sighting_of_ref": "indicator--8ed681c6-f25b-455c-8bf6-b223c46d527d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90b1c52c-517a-4611-941c-af3af6553c1f", "sighting_of_ref": "indicator--bbc80846-eaba-4d87-8598-0828798e4d54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--840bdf74-7111-41c1-a292-f53aa763112d", "sighting_of_ref": "indicator--4878d72b-16c5-41b6-8370-bf18ca093eee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eda223a-a24e-4944-8154-aefe701a6888", "sighting_of_ref": "indicator--12e5c7ef-c909-44fe-b110-a3a28ccedd99", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd0ec70-357b-4be6-9611-5557e6b0296c", "sighting_of_ref": "indicator--9307d9f4-eed3-4860-b3e2-fc2230135f33", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b932b676-ae66-4a27-b2f3-d4651a662282", "sighting_of_ref": "indicator--75bcd732-3d58-4848-a2d8-d666968717ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd7b4744-c035-481a-aba1-6719d67d1b43", "sighting_of_ref": "indicator--ba459b3d-9501-4119-bbb7-2833ddce404b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae21892e-d575-4e3b-8e12-6d0500c91cbc", "sighting_of_ref": "indicator--b37de932-38e9-42a3-b51c-150118c18e69", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e95df434-6415-4b2f-b509-d38e88828ed3", "sighting_of_ref": "indicator--6d87376c-608d-4aae-82d0-0be9808bf9db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdadb08c-6d7d-48d9-8a1c-f596fa3ba656", "sighting_of_ref": "indicator--6441c559-79ad-4352-8410-834a4e1e4b14", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb08525e-9293-49ad-9ea9-90cf082f4115", "sighting_of_ref": "indicator--f6c752c3-96e4-4fda-8854-63fa680994f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caf74b92-87c3-4e7d-a6c3-96c973eaea3f", "sighting_of_ref": "indicator--638ea721-ef43-4cd8-9b81-71a820b1ba7d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b818a903-2312-4cef-83ee-a5c3086a7875", "sighting_of_ref": "indicator--7e3c09ee-e289-4525-ad63-55ba1c6f97e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f860ad1c-cc0d-4c8e-bc4e-db5b1a9f9e06", "sighting_of_ref": "indicator--e2d2fb60-5a88-466f-9488-3819c27a23a0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--457a0299-fcd7-4b21-8b53-0f5db3869cfa", "sighting_of_ref": "indicator--bae332e8-5563-4928-9e64-4675cff97c7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cc7547b-9c43-4a1d-87a2-1d7f43c8c053", "sighting_of_ref": "indicator--dc8f67cb-e5b8-46f5-b329-d80a55067f52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1a745b-936b-4878-99a5-c7e5310e1c56", "sighting_of_ref": "indicator--40ec46ba-6658-4baf-a287-0bac3daaad8f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed31c581-40c3-47c1-bad6-d3d2bd429448", "sighting_of_ref": "indicator--cfbc1e13-7603-41f6-9111-39c30afbc1cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62b54d71-832b-4390-917f-8ec024aae2b9", "sighting_of_ref": "indicator--12560346-c4ff-472a-bca9-024d879d768b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddefa77f-9109-46e3-8183-6dff254b3888", "sighting_of_ref": "indicator--c1a2a219-f58e-43d0-a67b-d6bc757fbad6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1addee4-1893-4dff-94b7-2f5bd613adec", "sighting_of_ref": "indicator--d885add7-bfd8-4c50-86f5-6580435503a1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2100f201-b895-4a6f-9cf1-465218632b09", "sighting_of_ref": "indicator--f4df18a2-3f4d-4920-98cf-296be1044c78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c5ad32e-dd80-421c-93be-acc09b71d563", "sighting_of_ref": "indicator--77d3789e-0220-4fbe-918a-5e1341830777", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f65b018-2a1f-4eb8-90dd-2b47f96b99a5", "sighting_of_ref": "indicator--11e56e2d-7974-41a9-939b-42a86ae51462", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be6b41d-82b8-49ce-a9b0-f0dd47749d87", "sighting_of_ref": "indicator--c49f96b5-531c-4902-8fc9-48bfbbdb3b13", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc716195-8d67-4474-88a3-b1fb8e16c397", "sighting_of_ref": "indicator--13766c2e-30d9-4fff-8bd4-9a79bb88da19", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ba5e0b5-2fd9-4f13-abdd-301783e14b1c", "sighting_of_ref": "indicator--310c2ce1-dc7c-4b53-9aa6-657122bd7faa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c91eba9-f4bb-4b4c-a65b-301299e8050f", "sighting_of_ref": "indicator--6cae55f4-eeba-4175-91c1-dbb8ff4c0d66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36ea7279-82c9-44f4-be93-290af24ace8c", "sighting_of_ref": "indicator--ecf17522-e950-43f5-97a6-398b32082f63", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65520d51-7710-4e3a-ae85-34823b2074d4", "sighting_of_ref": "indicator--7b9ad99f-b5e6-413a-b8d5-fad7e5a20f96", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57c01c2-dc43-44ab-b34e-df53170b4dc7", "sighting_of_ref": "indicator--6fba4926-fbce-451e-9366-f42aa6fbcff4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4ad3ca8-7081-473d-89fd-83b5eb029b41", "sighting_of_ref": "indicator--d08f23cd-750d-429c-8a7f-1c78733a0ce9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c11e89dc-f7ee-4036-b28a-9fab2dff8508", "sighting_of_ref": "indicator--2ca33757-cbb3-49d0-992f-53cbedab4b6a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ab07e7d-7700-4245-b9b8-caea874800e2", "sighting_of_ref": "indicator--ceaacd9e-f359-40db-b11e-5cbf20476668", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a375bd2-69de-4472-b905-3c178a2c5f4e", "sighting_of_ref": "indicator--1000f488-8e79-48aa-997a-126fc3a28640", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f49eaad6-f246-45e4-8274-5cba6b02d47c", "sighting_of_ref": "indicator--e8506c49-6964-41b8-8efa-9b399de61242", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e173a0b-5134-423a-96ea-1ab5c4235c78", "sighting_of_ref": "indicator--b9c4783d-6f4c-4514-91b0-ef3257ebea08", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92d74e33-9382-403d-becb-f9fd16b28bec", "sighting_of_ref": "indicator--528bdf5b-c3ad-45c1-8a3c-1216aa94b98f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab0f5d65-c907-4033-a794-7811c79fc152", "sighting_of_ref": "indicator--babfcce4-a37e-40c7-923c-c0e1d8f41b50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b6fa96a-e4d3-453d-babe-6751f5b01de2", "sighting_of_ref": "indicator--d6cd8b1a-569c-4b7c-a14b-c134f4c24dba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4a318c6-82f8-4436-831e-dc3be109acee", "sighting_of_ref": "indicator--d759de9a-0e25-4449-aebf-89fc75c00e11", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3a7c7f6-34cb-4bea-a7ec-02b8081f06bc", "sighting_of_ref": "indicator--d29d60bc-6a33-427d-a864-75e7cf57bed3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eafd4d7-09cf-4a2e-9895-685e7f0748d9", "sighting_of_ref": "indicator--1a4fd84b-ed48-4e4a-ab2e-778101522d1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99f3bf10-acfa-4b34-aa1b-6b70806c1ca6", "sighting_of_ref": "indicator--eda5ec46-e6f6-45ba-940e-83d11342173b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd611ea7-51d5-4af9-a37e-199ecc157c7b", "sighting_of_ref": "indicator--4f6d0bdc-1d28-4720-bfc0-0fc0c786cb24", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--068655b0-a107-4d1c-9a24-05b698edd626", "sighting_of_ref": "indicator--393cc871-9b23-4d26-baab-b906c3e6e334", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a9e9d39-36e6-49fb-95c7-474decfe125c", "sighting_of_ref": "indicator--c3f3e9d2-f4d7-48df-bdaa-70459c8b0fce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7317cbab-24d6-4756-b8e0-f80639722a3c", "sighting_of_ref": "indicator--b4b85a38-ae9f-4ab1-b273-1e2d629709b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e8ee880-ff9d-42ef-a304-805c0206a445", "sighting_of_ref": "indicator--b7f7f1f0-e900-46c4-9a70-4823a08e8017", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fd8acca-69a7-4db5-bb7f-798bfd36f50c", "sighting_of_ref": "indicator--365b9996-58c2-4d92-bdab-e6a5da8f9d48", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c193db2d-4c41-4fae-a41a-cac0bc3dbbc7", "sighting_of_ref": "indicator--5e6123f0-908b-4512-ab57-a6245e4d9e06", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7f13e97-4cab-4e21-9123-6c677330eba8", "sighting_of_ref": "indicator--4e9dbc82-d303-4b2c-8619-051d42714166", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ae9b9ae-5f4b-4d89-9113-647882668f63", "sighting_of_ref": "indicator--528da01e-16ad-460b-a652-033981c33fc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68d4fc9e-13cb-4817-b5f0-f3855bce529c", "sighting_of_ref": "indicator--314b81cc-c9a5-490d-be34-06512a0077cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29423582-5e3c-45bb-bd67-90311297fdc9", "sighting_of_ref": "indicator--fa21569c-1238-41f0-af74-b4661db350bc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0acf5745-1808-47a1-8ab1-b596e70f40d9", "sighting_of_ref": "indicator--f2cdbce9-00fa-46a2-98c7-f5d64d2a0af4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f195f9bf-a30d-4c6e-991f-ae4a54d3a90f", "sighting_of_ref": "indicator--b8e5b290-9024-4ede-b62c-04ded42de70c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f9276a-a989-407a-8027-b3c6d61d9b88", "sighting_of_ref": "indicator--502e6d20-9668-45a8-a178-f03d00b17498", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--332c23c0-81fd-4cd5-8810-7f58753b93ad", "sighting_of_ref": "indicator--d972f4d1-1387-4f82-8460-33dcac2312ee", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3443a7c-b96d-454b-99b7-a6846649b046", "sighting_of_ref": "indicator--971e2d56-be8f-43bd-a37f-0a842211b7ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec6adcac-77dc-4367-a8d1-ca267f88c092", "sighting_of_ref": "indicator--acbb10aa-4aa7-4173-b13b-1ef655ed4c67", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a0a014-0851-4d9a-b96b-38e943601a78", "sighting_of_ref": "indicator--fa341dc9-348e-4a35-81c8-6edf235fd4fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451a9261-b2cd-48a6-846b-f15795fc6c84", "sighting_of_ref": "indicator--7985bf99-4534-454d-820b-2ce14dbde064", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0ca94dc-9b75-4c65-baa9-a326f4032c05", "sighting_of_ref": "indicator--cb38ee7e-7821-4757-a5cc-d727c48d4296", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82b0e60b-964c-4cb4-a5c2-1abb6b2e2f4f", "sighting_of_ref": "indicator--a2550b73-06d2-47e6-ba7f-a77f8fd60444", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbaa21ec-b538-4975-a6a9-186f0de2e6a4", "sighting_of_ref": "indicator--70b9d8c1-a426-4e9c-bac9-3c133534a2fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74bd6f05-0fe9-471d-b0cf-dddec2222812", "sighting_of_ref": "indicator--e216bff5-be1b-4dcb-b734-09238839c0fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec844d4-e29d-47a5-a51f-79340fe88edd", "sighting_of_ref": "indicator--5ad1ecdd-1c5b-4717-9b01-b9e32ac1982d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ffa1a9c-469c-4d31-9043-d5dc6bc05537", "sighting_of_ref": "indicator--d14b73dc-aa4d-4fc5-a054-9a4494481082", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85272925-7147-4fb0-9c8a-07a281a85c48", "sighting_of_ref": "indicator--f27ef40d-f821-477e-be35-cc7b70882005", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9af5c40e-09bf-4704-b23e-85d323ab57f3", "sighting_of_ref": "indicator--f0cf699e-e0dd-4668-9cfc-a50988ddbce9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60076718-0546-43ae-b4dc-d90b08f3a776", "sighting_of_ref": "indicator--44d6656d-4f7f-4ca7-bc5b-e793e7b47e07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--928f3479-8329-4073-a144-411f829820da", "sighting_of_ref": "indicator--05fc7a3b-163b-4625-971e-cc4f29d5867b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67e5eed4-e08c-4667-8a37-c7f1808abd78", "sighting_of_ref": "indicator--21c18383-c7a9-44c1-8edf-1e770d192e3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1994fe6-ac46-4669-9058-b231c9a32987", "sighting_of_ref": "indicator--d07f4ab8-db3e-4e5a-a58d-61a78b0735d7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e18ab3e-3693-4b0c-9881-3219a83297a5", "sighting_of_ref": "indicator--28bb430f-d5bd-4103-add0-ce90b5ad7f55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ae13a3e-4560-4965-88b6-03f896789853", "sighting_of_ref": "indicator--9bd7d66d-d951-49ea-9632-5ff52d4674d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a3817b6-312b-4fa0-b62e-8cd4d6749fe4", "sighting_of_ref": "indicator--0bd5ba31-3bb7-4aa4-90e4-c05d5f05e9f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cb9532a-777c-4ac3-b54f-805146d09943", "sighting_of_ref": "indicator--3f677459-4957-4343-b461-319ecfd33676", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--491a2fed-ba8c-4291-bc92-f8d3bae32acf", "sighting_of_ref": "indicator--911a9033-09df-40b6-a5c1-586657600319", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1af6daa5-0496-4501-8d73-a8b07e89599e", "sighting_of_ref": "indicator--33f06b21-b8b4-44d4-8a9f-bc18b7125adb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e098c5da-c394-4d74-827d-439028f07103", "sighting_of_ref": "indicator--832ddd60-2334-4697-af8d-bea3beae5243", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2ce51e2-7ddc-41a4-9252-59a9bd17152e", "sighting_of_ref": "indicator--112701be-5b1d-45c0-bce1-c9b640f1df4a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ede4a3dc-3b34-4752-9acf-5a7df0f693f3", "sighting_of_ref": "indicator--723d5ceb-dda8-4f68-82d6-0cd9a2eafe94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a8c8b8e-68f3-41cd-8c6d-57b863a081d6", "sighting_of_ref": "indicator--7b771eb5-a89b-46f7-9534-dd58b97725b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674b2c31-018f-484d-b055-313b7cb317cd", "sighting_of_ref": "indicator--c9900af4-7f96-4ee7-b87e-dfd3ea23f6e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe048ba2-e402-4422-9a72-89dd19932d0c", "sighting_of_ref": "indicator--fe1d3b91-99df-49c5-ab69-8d07489a111a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7842ee81-e09e-44e7-ac23-816e2f5149b2", "sighting_of_ref": "indicator--a11c1ed0-c337-425f-aa78-6d7ca30c4af2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8f6b0d4-96f8-4e04-b992-1b4a23aa471a", "sighting_of_ref": "indicator--f48be31c-25d0-4a2d-a31f-5ba1f1e7ee18", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65378c0c-51da-45f7-9b1e-179a737c44fe", "sighting_of_ref": "indicator--20b96e19-f915-40d6-bf65-6253139542a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5b3834e-918d-49a5-a531-fb1f93a5498d", "sighting_of_ref": "indicator--90c052b6-199e-4c2c-9893-71d59596fcf4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124ee45c-3ad4-4574-970e-fe9a2e1948e8", "sighting_of_ref": "indicator--f719e5d6-e336-411c-ac47-e9bc300e54aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56cd91d5-d50c-4a5f-8bed-c95de132a37c", "sighting_of_ref": "indicator--b0eca258-c4ee-46c2-abc4-0ee0902f363e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70425e68-8495-485c-8fec-3ec424616072", "sighting_of_ref": "indicator--54cd787f-7b6c-42c0-8c01-35eb42ea6e10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d76c68de-7904-492b-b137-c80cbb407b2e", "sighting_of_ref": "indicator--89df2e09-d43d-4078-bf75-28d0525a4b13", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de1aecae-b3a6-4be3-a1b1-f4ea77e30c40", "sighting_of_ref": "indicator--0c9a2a64-d29b-4c3e-a2e1-22df06e2629c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe3d23f8-07cf-4e7a-8cf7-4734fb49665c", "sighting_of_ref": "indicator--f29d4d7c-d311-49ee-a55b-30e3a426a641", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5820d2f-83c7-45f6-a65d-2078ccce0f61", "sighting_of_ref": "indicator--a7f43f3c-0c91-4ba4-94f1-4a034b918231", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4b7979-7a34-4a4d-8c40-bacdf7abc146", "sighting_of_ref": "indicator--b52273fc-cdaf-47dd-8b02-6a6fe9a5bf64", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae3ab137-314d-496a-afd9-32f254b9a9be", "sighting_of_ref": "indicator--1d8ce969-90ae-44e6-8608-04654f92eb45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a5604f7-80de-40e8-9150-559db46dbbc9", "sighting_of_ref": "indicator--fe0bae7d-9796-4295-9217-e7efe6c07c87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b061447-b75d-41a9-98c1-7c54b83d61d0", "sighting_of_ref": "indicator--c528958a-2487-4af4-97da-65a4b8f7aaf1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ba125a-43e0-4c26-a91a-4fa09ca58b41", "sighting_of_ref": "indicator--f8509264-5be5-491d-8a53-5125cfe8cbcb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bab4bfd-f047-45f4-80b6-90c683d61197", "sighting_of_ref": "indicator--9baba5c3-422d-4a01-a48d-718727f9d61a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbffaae7-99ab-4393-8a49-ded4d5a9d4c9", "sighting_of_ref": "indicator--dedd953b-7b63-4a31-9f3a-17ecfc261b71", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--692b0455-5a39-466c-ba95-28b3b6b4a2f1", "sighting_of_ref": "indicator--fd75eeee-9b87-4231-84c0-de7c0a578891", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38bae886-475a-4efe-ae0f-2aaaf8e20085", "sighting_of_ref": "indicator--4f3396bc-77ad-42d4-8780-2b2c3d534021", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--904bd66c-75f9-441e-b214-2a4dc478270c", "sighting_of_ref": "indicator--455db7a8-e740-4dd4-baaa-845a7ec61b3d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2c2e28c-0386-41ec-a1e3-e0c7fc0ea8e6", "sighting_of_ref": "indicator--f01b8d82-897a-49f3-8679-8c9d83e92ea3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f88c4a0c-4a9d-4da9-a2da-cf3aaa6861dd", "sighting_of_ref": "indicator--f01b8d82-897a-49f3-8679-8c9d83e92ea3", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3198f70b-fbc4-403a-bd4e-422fe4c579d6", "sighting_of_ref": "indicator--23735906-db77-4054-9fd4-ea15adffa218", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3e5bc85-f904-4e93-86dd-06107f9ec053", "sighting_of_ref": "indicator--0c58ee24-4019-4710-889b-efc729eb5733", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c28731-7364-4f82-b5e2-8333fda9df8b", "sighting_of_ref": "indicator--9fa11c71-add8-4c0d-9931-5b46db816ff7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14fc7ea8-635f-4475-aa8b-4766e29ce970", "sighting_of_ref": "indicator--661cc194-49a1-4ec8-a586-26e3714081b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720703eb-ec77-4067-a4d6-dd9fe1710643", "sighting_of_ref": "indicator--a7ed5011-a360-437d-a032-f1eff85f6e30", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--510926e3-52fb-4f94-ab97-670a50df783d", "sighting_of_ref": "indicator--42edc694-a609-4b02-a5db-d2092022b61b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc627f11-8d72-4e8b-be37-d731e0301b9d", "sighting_of_ref": "indicator--57b1cbac-8085-441f-a80d-9ad28b2a1d1b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e11229-f0c3-4336-8967-8075927369ce", "sighting_of_ref": "indicator--1539f9a5-ed96-4411-b529-845370eeaccd", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a5bfb5-c4b3-4a43-b505-438b6b7efa04", "sighting_of_ref": "indicator--4f87a3dd-2404-4096-9dad-1a794c89a7dd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd2d55c-b9e3-4afa-990b-fce5c69ecce7", "sighting_of_ref": "indicator--d2f1d423-c44c-4d35-8ca1-be5991b6d631", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b745fed-e99c-4f90-9b6e-9dd4a58e15c2", "sighting_of_ref": "indicator--3e08648f-bcee-481d-b9fd-90520175545e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9adf3513-b361-4083-8b90-50bd3745dcfd", "sighting_of_ref": "indicator--67ee8ef2-73a2-41b6-854b-52a7ccf30357", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25769be5-62f2-4e13-9713-a96c1cbd5f3a", "sighting_of_ref": "indicator--f64047db-9847-4d2b-8b39-17e5ead38c38", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--130d2c26-4ada-460d-99f6-01d1e645ae83", "sighting_of_ref": "indicator--dbb17212-aabf-4eb4-9b13-679cb5d239c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded91e01-d963-4af0-a2fb-54ec2bd89881", "sighting_of_ref": "indicator--120ec3f0-b065-4a54-b43e-b14039ca0a7f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc415ea-4a26-4ced-8505-a682ac85e862", "sighting_of_ref": "indicator--ae4fdb9e-3d7c-4383-b138-a56661928a2c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85405aa1-becc-49eb-b722-3765a3b4a0bd", "sighting_of_ref": "indicator--dc784fdf-029c-4057-a763-1ff39a2af4e3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d08d9291-e9d7-4daf-b01e-893f5f6a7fd0", "sighting_of_ref": "indicator--108c2272-45d5-4bc9-9ca1-371961c789f0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--230c6a72-899b-4d2c-b699-17db7e52606d", "sighting_of_ref": "indicator--88b19a25-fb71-4e9c-8596-c6dd82dd49f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--114f240b-00ff-4082-adc9-ac763d905c36", "sighting_of_ref": "indicator--0424d16e-b691-47fc-876e-345fc8b088e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bc43fae-cb16-47bd-92bd-071e997b78f9", "sighting_of_ref": "indicator--28a02bc9-030c-4d1b-aed6-b2610866879d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9547afd7-e4fb-4131-b078-4b1d1e3eeba4", "sighting_of_ref": "indicator--803b62c1-30cb-4602-b9b1-e5a73dd5564f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--925d04b5-90c3-42e6-a015-5d6a20c508f8", "sighting_of_ref": "indicator--bd7bfdb7-36fb-43bb-8a2a-f447c7e911db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39c52e69-a011-40c4-9135-b36ebeff27cc", "sighting_of_ref": "indicator--769a26fb-a043-418e-a5c7-2e3ec193166d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac2a9ad8-8915-4fd0-9067-722f468d1f28", "sighting_of_ref": "indicator--30d3814b-d27a-44e6-9163-adda2e823cbc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66a00a6d-0fa0-4e21-bf08-08cf94cf01e8", "sighting_of_ref": "indicator--f49d9585-9014-404f-9cbe-4f1619fab0da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a1283d-3912-41e6-9f79-fb78e7040af4", "sighting_of_ref": "indicator--8dd0f86f-1650-457b-8aac-a798e4c4b465", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--342644ec-5f54-4a16-a986-0862db4c97f8", "sighting_of_ref": "indicator--e841e6b5-8e17-421b-a849-b3e54e780ebd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af8cc755-8750-4304-84ae-2e1d1da87ce1", "sighting_of_ref": "indicator--7f22d91f-355c-45ec-a60c-dcd2d7e0a461", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5adc714-269e-4835-ba81-00e0113aba46", "sighting_of_ref": "indicator--0e821eb6-80cc-480b-8ed0-2d4ef0fe1692", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0236be1-b75f-4f9f-8c84-53944c8f4fa1", "sighting_of_ref": "indicator--a992847f-cb37-4f99-823d-89e88a358675", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8abc07f8-181e-4556-b6e5-35d428b7a64e", "sighting_of_ref": "indicator--ca7523c9-eadb-45e5-b075-c30dc3b7e08f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d7647aa-dd62-4d64-801a-f3776bffa835", "sighting_of_ref": "indicator--cbb72513-44f6-4af7-bba1-343a50741135", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--046d9892-f362-4b63-baa7-29a4fb5608d2", "sighting_of_ref": "indicator--a3e47867-c51b-4af4-80d5-25efc040b273", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b91de2d-c82d-4024-abd7-a2b64c1cdd21", "sighting_of_ref": "indicator--813af638-3c97-4f32-8dd5-08437adfcf4d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f07157-2ab7-46c2-a2da-af5398a04859", "sighting_of_ref": "indicator--5e49c430-fe14-44a0-95f1-8c2aa0019ec4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c14d74b0-c6a5-4e9c-ad0d-41af4335d678", "sighting_of_ref": "indicator--5032326e-bf81-42f3-817f-48eb5b60a772", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4767df41-fbb7-4b22-8d2a-79ad4d6d81e2", "sighting_of_ref": "indicator--d312386a-5afa-45b5-91bc-d7b751df8360", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef24c68e-529f-4c5e-b24d-60b6754ef45c", "sighting_of_ref": "indicator--592b1cb5-f165-4898-93ce-9d9167c26cd9", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5263b478-9ecd-4628-84fb-feb86692d6cd", "sighting_of_ref": "indicator--3b652d02-9cb6-454e-8144-87e5c096edca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11d1bebb-4987-47b6-ae8e-f02571700f6d", "sighting_of_ref": "indicator--f028b334-984f-4354-8620-2e3fceede59a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0464b0-f31f-4a0b-a756-2bd392d13872", "sighting_of_ref": "indicator--17c9d878-c33d-4792-a4b2-a2575c92784a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9696d2d1-0977-4309-b2d6-f14ebb0d3b23", "sighting_of_ref": "indicator--830e970e-04f8-4c42-9ad1-b6143d280610", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a62b5bb-4c1e-406c-9c4e-1aa8fba6cf70", "sighting_of_ref": "indicator--8a97b06d-72bc-473f-80ba-3ea67f16bd4b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800ce377-f65d-4297-9adb-e964ec40d4f9", "sighting_of_ref": "indicator--84e2f535-3308-4a06-8a24-a0e1f07c461e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--987a8779-c987-481c-af77-04d850bdccbb", "sighting_of_ref": "indicator--e708be42-f5bd-493f-8127-3290d0c54a93", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ebd97e8-367e-45a3-b21e-a2ace0dfbd2b", "sighting_of_ref": "indicator--54812680-2a34-4630-ad8e-aedb7cf7d8c3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4203db67-8d65-438d-af15-d1ef9561d735", "sighting_of_ref": "indicator--34653479-aa1c-4197-9d32-7e30b06d38fa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a9f2bb6-e1f0-4dd5-852f-b0548f11720f", "sighting_of_ref": "indicator--45568f5e-061d-43d2-8ddf-e61236fe920c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c06c8990-77d7-43f9-9844-4cb181bf1e5e", "sighting_of_ref": "indicator--be8c8f07-a4b7-46d6-81df-86864a58a403", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b20b3de-c226-4697-afa4-3045de06902a", "sighting_of_ref": "indicator--23d05965-7217-483f-8697-a0142b39d241", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a77b815-4d43-42ff-bd39-f898576c14ac", "sighting_of_ref": "indicator--e50e6e16-9487-4fd5-8fb6-441aa115e409", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6f40320-ac90-4ef9-9ca6-f0ca65a17558", "sighting_of_ref": "indicator--718e8ceb-b459-4110-9c2a-2a5acaac6df5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a780c298-1170-4f4e-80a8-779542e7abf8", "sighting_of_ref": "indicator--97e29d94-e04a-4ba5-bbb0-25f69ff9339c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dfcf1fd-f2db-4b94-b7ce-3b5d7b9d80a4", "sighting_of_ref": "indicator--e64e415a-4c9f-42b0-aead-105fba0dc3ae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f408620c-a847-40bb-9409-383753ac76e7", "sighting_of_ref": "indicator--6e884a01-cc25-4e60-8aaa-db4ecf6ea8be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad8c7602-772b-4350-a316-b8670238da5f", "sighting_of_ref": "indicator--7f17b25b-ee68-4680-90a7-d1d2786ecb13", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5996cad-31d8-4dd0-88e6-6b14326d5e12", "sighting_of_ref": "indicator--52830bcb-1213-47a2-b922-429e6f5292e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2453259-4086-4576-981f-b8a9cbd342d3", "sighting_of_ref": "indicator--1172fa96-95a8-4aed-a0d2-c794d246a9ca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a1afe4-24bb-4016-bac0-07203534eb66", "sighting_of_ref": "indicator--e5f0c48d-26b8-485b-a163-016b94f94a57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37981495-e18f-452f-87d6-a2ce229d8e96", "sighting_of_ref": "indicator--dce18864-326f-494e-b73b-d80c2e42620d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bb88160-cd44-4555-9cf4-c59f36edb89b", "sighting_of_ref": "indicator--0d480c17-7ea0-4490-a302-e7d6f4fa3b00", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcdf3e09-e6e0-4529-8200-7156ca969414", "sighting_of_ref": "indicator--de6942d6-04dc-4d47-bb0f-25c34cf225e4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3aad21-af2e-44e3-8bf1-f9ed5a13fa0e", "sighting_of_ref": "indicator--e36b71fd-80cb-4c1d-8a06-85b19e9bd3ce", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a93cc00c-f502-404d-b27e-ad3033add1c9", "sighting_of_ref": "indicator--5692fd5c-49bf-445e-acd2-e5427506bcb2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e8a4901-f847-4f42-be1b-8b51a7427120", "sighting_of_ref": "indicator--4b1ee2cb-d207-4e94-8e46-050b5158b69e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6222d74d-1b07-4682-ba02-95eb0e6bd89a", "sighting_of_ref": "indicator--53fe0eb3-d0e0-4169-9e5d-d65a77ef1e76", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe3b861e-68d5-4a24-8278-0ea505a951ee", "sighting_of_ref": "indicator--eecb3950-9925-4fa7-bf64-481b4994f584", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0768b0fc-e4e4-4e85-ab99-839322728eaf", "sighting_of_ref": "indicator--d39caab0-495e-4d1f-b69c-80d96c9b60e1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e73f47-3428-48de-8739-80417c31801c", "sighting_of_ref": "indicator--6a8b0584-aac7-42f0-81e1-0781652348c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7ca6a14-5d78-4c4a-9776-1dfb8c7c323d", "sighting_of_ref": "indicator--53706b53-970d-4a3f-8762-d83894c91c0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbea01ea-ca67-41f9-b30c-dbf8e2ec8bf2", "sighting_of_ref": "indicator--874107dd-e4b9-4b09-9649-147e9f81f0e7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbec4e1c-034e-4a04-a596-0417c1cce2ae", "sighting_of_ref": "indicator--7a2f22c5-75c9-427d-b67b-fb38684ed1a3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daf3c5a6-958d-456e-9496-feb84ac9e87a", "sighting_of_ref": "indicator--3b64684f-7317-4379-8e4e-991aed0c1491", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580a7021-e2a9-4b21-8aa8-e7387bc442d2", "sighting_of_ref": "indicator--76a082f2-fc16-4b90-8a31-b00f1a5c8602", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c1caea-2e80-49d3-ae94-c726d2a4647c", "sighting_of_ref": "indicator--68ff0fae-80bf-452e-8ab5-3ba120bc5cc5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b038b9d-77f6-4c81-957d-7d59686f3194", "sighting_of_ref": "indicator--b6354b2f-37a4-4ec7-94d6-d55fe117aa21", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa7e7e4a-13c6-4208-8433-74fe6f4791d0", "sighting_of_ref": "indicator--7462e24f-4216-441f-ae05-f4181f097e1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1c16974-3ac9-46fe-ac3a-ee13815462e3", "sighting_of_ref": "indicator--8e4c1e90-b3a9-4ed6-b482-2886509eb1e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--590c8d3f-8dd6-4850-a33d-9eda910de561", "sighting_of_ref": "indicator--6694527e-dd22-4815-bfa7-a30c28b355da", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97dd5817-5539-47e9-9244-7c69c7286d00", "sighting_of_ref": "indicator--c6b4a85d-583c-4aa9-84fc-71abc1317450", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84a0958-c0a3-4d96-a3f5-4395d06a0307", "sighting_of_ref": "indicator--1fcccba3-2058-4db0-b828-64738b1a297b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a927cf02-f060-40d8-be97-5c14e228c64e", "sighting_of_ref": "indicator--511c66b1-c1a2-4f59-90f8-620db240fe70", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f30199c-b904-4b95-b131-80b628ba148f", "sighting_of_ref": "indicator--272e3eed-5cc4-4402-9f57-736628fd6710", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4f116b4-7619-4921-845e-efed7d669c2a", "sighting_of_ref": "indicator--5d911ddd-668f-4d11-871d-a8e49844e653", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea6154dd-ac03-4bc7-ae29-880b12cafe8e", "sighting_of_ref": "indicator--7788f156-edde-4f65-89c3-2e3e525a3e66", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0933e95-51f6-4e59-8677-fcc5d50ee12f", "sighting_of_ref": "indicator--012c4376-2a4d-427e-a905-e1e913af4b2f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b64d34b-db2c-4935-84ab-e1045d7ff567", "sighting_of_ref": "indicator--2e2fe9e5-52d3-4803-b731-000a2c5d391e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38b26b5-f34d-4f0b-8ccb-82ea2886b2ca", "sighting_of_ref": "indicator--3bd98d0a-d7cb-4ee1-8a37-211a8690dbf5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc208455-b362-4ea5-80a9-ed0700183f4e", "sighting_of_ref": "indicator--40e2f950-1243-4847-bbb6-6bfe277e5350", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc29ad0-3925-42aa-a9ba-b2151f7a165b", "sighting_of_ref": "indicator--b2980892-3228-4b01-a2f6-960088a59f58", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf3baa4-5933-4e6b-bd20-119c190dc830", "sighting_of_ref": "indicator--01053845-6ffd-4420-b90d-4425bf988df5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dedbc30a-7233-41a7-888c-15de985d9add", "sighting_of_ref": "indicator--18836d87-4c42-45aa-a248-ff2286014c51", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bbc2ec8-9f2d-426c-8e4a-7f90b140f7c4", "sighting_of_ref": "indicator--f7bb56c6-79f9-43c7-85ae-337e603c4d41", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--140d997d-9e56-48ad-877a-3460222fdf23", "sighting_of_ref": "indicator--a07ac76f-3ef9-43a9-aab4-bc9305fb3d51", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc05dec1-707e-4318-ac36-64baa15c0586", "sighting_of_ref": "indicator--698927c6-71ae-4f9a-92bd-d1e8241160f4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd95e8f-48d8-456a-90a5-fe88ae2a0ad8", "sighting_of_ref": "indicator--1e3f6c91-a21c-4104-a40c-d7da9c0076db", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb3ce293-6a88-4b9a-8588-b098a27d3a8a", "sighting_of_ref": "indicator--7470b777-3a63-49b5-8599-aa4c1fe23ea9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc6e5019-9469-41d3-afba-f7c4f9ffe5ed", "sighting_of_ref": "indicator--aaa73f07-832b-4c66-a809-642c815a7bb4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0728c180-afed-4cf6-b0c8-03d17a234116", "sighting_of_ref": "indicator--7259f608-ec14-4e80-b5dc-30468d4aa54b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8821f286-bcbb-415a-bdab-2bb19250524e", "sighting_of_ref": "indicator--3afe6a46-b163-4175-adfd-b28fcc7a92ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--787346f2-1b9c-4306-a551-89cdd76d01c4", "sighting_of_ref": "indicator--68991caf-617b-4cb6-9781-75a0317ee032", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33aa0529-ea4c-4524-ae2d-389d8d6a195b", "sighting_of_ref": "indicator--01ccb9cc-2540-4ca7-889e-7d19e2713cfc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0a96daa-8b1f-4e22-9fad-688ba551a9db", "sighting_of_ref": "indicator--75bfa1e9-955d-468f-8f2c-927460514b31", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5efb95a1-3302-46bc-8636-b6da1170e31e", "sighting_of_ref": "indicator--bf13505b-1f01-431f-b7a8-c806ea3f462b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c193409-de79-441f-9bd2-812e90acfac1", "sighting_of_ref": "indicator--fa8809fb-47da-440e-91dc-f13d46d381df", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b48f74df-6439-4ffa-a04e-6dd305e11ba4", "sighting_of_ref": "indicator--99062025-9fd0-4d3a-bb58-6c1bf9224272", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2206f2a7-a50c-4b84-aced-68a04a0fc6a9", "sighting_of_ref": "indicator--5331b9b7-9e87-4cfe-ad22-c30a1123a69a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a827722-2e1b-4c11-925b-2200b819b86c", "sighting_of_ref": "indicator--80214fa4-50e3-457e-8495-f81188f4b04f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92edb2e2-8b66-4f0c-bd99-1c934cf714db", "sighting_of_ref": "indicator--2d23a863-f1f2-4a15-9a4c-faf9ab508a2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c01cec-3324-43a1-a509-8ffd01ea3e14", "sighting_of_ref": "indicator--1f63ed8a-4891-435f-977c-a172042fb9a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c94639c1-ef4b-4904-bfea-cef8eac695c6", "sighting_of_ref": "indicator--ece0d464-4e95-41dc-910b-ded149d4fad2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5df2b9-c003-463e-a309-533eecd864f7", "sighting_of_ref": "indicator--a18f4e7d-79a4-46a9-9cc9-27720b577fd8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--375daa49-b7b4-45c0-bf02-8bfdcf048b0e", "sighting_of_ref": "indicator--d9f82ba9-2a2c-4901-a1e0-a4b5ca2e90bf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--247e56db-7a61-4b27-9d54-5e54af10383b", "sighting_of_ref": "indicator--6aab3a1d-2366-4ece-96dc-b343cac0e4e8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6578126-3a79-4e6e-a6be-45afea840b9d", "sighting_of_ref": "indicator--a74af707-a823-411f-88f5-90923dcdd631", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82cef4f8-edf1-419d-b389-ff5d46a67976", "sighting_of_ref": "indicator--a64c3fc4-486d-49a5-af5b-afd5c7cb0421", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf2fc2c4-4d6c-4910-88b8-2300ba03d4fa", "sighting_of_ref": "indicator--641d3d52-b2ff-4b87-bde0-244383a5cc94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6218e79a-9d7c-4555-ac73-a1a53ee11e5a", "sighting_of_ref": "indicator--fc08b647-4a79-4fb2-a036-d059e0dafdcb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe44f94-e73d-4008-88c2-cafb717ce783", "sighting_of_ref": "indicator--bbb9f259-58a6-422e-ac5d-03fbff1e7435", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9be884-70f7-4b06-acad-f7fa6892491a", "sighting_of_ref": "indicator--b66de1b3-ef01-4a97-8648-3112e95a825e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2b2d96-f37a-4e06-8c24-5500d9e4f370", "sighting_of_ref": "indicator--92b07e0f-cb76-479a-b7e2-f1a20a8f9e11", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e1d316-705f-4caa-b021-726e8773f440", "sighting_of_ref": "indicator--8cb67165-72c8-452b-a0b4-765d7065196c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--322c541b-53e5-4c4c-86b4-c49af29379ad", "sighting_of_ref": "indicator--8ff19dd0-6915-419a-be23-421cd309aa82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3e69c07-fede-443b-8374-8524ddf78565", "sighting_of_ref": "indicator--f2101293-f991-465e-a91f-9ffeea0b473b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08555995-69d8-43f7-8acf-7d11bfcd684a", "sighting_of_ref": "indicator--2d2dd76b-9f57-4347-a5fa-26d32dd7fe5e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c4ccbc-41c5-4cf1-8eeb-3dcb7d336934", "sighting_of_ref": "indicator--f2b06c01-18f2-4592-a063-2ba223b443e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ab52dba-a0ac-43fb-be71-e41ce49b7a5c", "sighting_of_ref": "indicator--05235a1d-31d3-4c40-9b06-6f15aa3bf0ee", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cb09084-d0b2-4957-9062-622b3c283b0b", "sighting_of_ref": "indicator--d5f18b56-bcb7-4d3b-ab02-3feb73d12a9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d42173d-a049-4be1-9248-8189c37da44b", "sighting_of_ref": "indicator--4d15406f-264f-4c7d-aaad-ef14eb6fb147", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ec8900-23ad-4d17-9d1d-d1fee5ff71cd", "sighting_of_ref": "indicator--2ee1fb41-3d67-42b8-8a01-7450054fb82b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd44534-dc6d-4040-82e3-418e8aa1650a", "sighting_of_ref": "indicator--275b18ee-2404-4e96-9513-ae13c11478e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d2303c-daf6-4bfe-94da-1c97e544a01a", "sighting_of_ref": "indicator--e9fdcc1f-ecf6-4a1b-90f3-9f42017c1c20", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--129e1f95-dcd8-4b57-837f-0a044cfa4d03", "sighting_of_ref": "indicator--529a3e6c-00ac-4695-a79f-d09d7ba2eb0c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d81f540-a6da-48f6-9a95-70558cb9b1f4", "sighting_of_ref": "indicator--5ae75e25-c3b4-4ec7-bff4-4307fc095b7a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a315c4c2-a674-4431-8b1b-f6edc7165b53", "sighting_of_ref": "indicator--36c6d9b3-5129-4872-8b3e-f485a4a90944", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ff5d3a-8303-460a-ad79-f925d2110e9b", "sighting_of_ref": "indicator--838277b7-6a49-4854-839e-2663f48443c0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--757f0ea9-cb05-40cb-bcf8-a627f9cb4ba0", "sighting_of_ref": "indicator--71fe4c7f-b4b2-49ec-894e-b5ca4b512347", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d29a3d-ec70-473f-a567-b2fa185dee28", "sighting_of_ref": "indicator--567d0795-8b79-48da-8fc0-15ba98e93630", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43684936-2188-4798-bd5f-16fda25be533", "sighting_of_ref": "indicator--53d6d692-e98c-44a3-8883-774e7a7cf2f7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37aac67d-67c4-40b9-80d0-32667bb80aca", "sighting_of_ref": "indicator--518c4aa7-e0d3-416b-9637-12612299f160", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--839e11ff-6c73-4134-8035-de4d3370eaba", "sighting_of_ref": "indicator--3d38e680-10d1-4396-8017-38a76044457e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53601788-1cfc-4fb8-95bd-bbce97386ff0", "sighting_of_ref": "indicator--616c1bee-088d-47eb-bdc6-006db1006799", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--119591a4-e14a-4f4b-8327-bdb662cf21f6", "sighting_of_ref": "indicator--e5ceae75-5033-48e5-b580-58cc33716a6e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31561525-cdd8-4dd8-bd99-b3fe486a739f", "sighting_of_ref": "indicator--40b6d679-7c56-40b9-b585-44dde7ec3d94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d43b08-1ca7-4ae9-b9b8-e0fecf46b9b3", "sighting_of_ref": "indicator--d5781b94-b6b7-4bde-9dc9-c518fbf93851", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d148afa5-5290-4c05-afb5-0c4b702c4309", "sighting_of_ref": "indicator--0c30c211-4eef-4a6b-853c-8837d02002ef", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb58c3f-b004-477b-a913-e27882f6bb2a", "sighting_of_ref": "indicator--1fdba83a-c860-4ad7-8d55-496e81fd98b9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ff09aa1-822c-415e-a706-827488e782d7", "sighting_of_ref": "indicator--fbe555c8-841a-43ff-9679-6288acc21e4b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3323f3e0-4713-4ba2-8023-61d001bb73c8", "sighting_of_ref": "indicator--ba7697e5-b30c-464a-a702-50a4bfc1fdb3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58b20591-1ffd-40de-8cbf-ee6adf965bf2", "sighting_of_ref": "indicator--21b67625-3a31-45ec-83f9-2a2c891f2664", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d9e1cf5-5dc5-4ac2-8e92-a3badf88594f", "sighting_of_ref": "indicator--03b44ca0-745a-4c39-821b-f52d816e65b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a25f0f-1feb-4014-957e-3f658d19ba4f", "sighting_of_ref": "indicator--0f6a0311-2ece-4da3-99ea-5563accabf98", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d03f9423-ff16-4440-8a1e-366e112886af", "sighting_of_ref": "indicator--7e04b8e4-f242-44c6-987d-fa02b79ec749", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3af91522-619b-4ad8-aa8a-59a6c9f1c726", "sighting_of_ref": "indicator--6eea0c6c-8bc0-4727-86cf-fc6a6d086d3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce314f13-8fce-43de-9037-970e92c494ab", "sighting_of_ref": "indicator--59f6445b-3597-4968-8289-f47d16085ed9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee02d2a5-43be-4d09-bf51-4fab2943064f", "sighting_of_ref": "indicator--d02575b2-be27-4092-90e2-172724d0b4f3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e71904a2-7572-48a8-8294-84fde9d148a8", "sighting_of_ref": "indicator--124fe4ee-2de1-4d3b-a11a-d4e3ba3e6a79", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b28af445-40af-4a3a-b3b7-f59363539ee6", "sighting_of_ref": "indicator--a2bee164-9239-42b5-92ca-b89f2fffde07", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269c1c40-6ddd-4611-b0c5-b7bc4dde8627", "sighting_of_ref": "indicator--c37da4ee-242d-4bf6-b42a-ed762f871a0a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c543dc3-1397-4bd5-9d0a-2d6a60449c08", "sighting_of_ref": "indicator--ce4eaacf-29d8-4237-85e9-142cd778a4eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b1a5d4-53c4-4f2a-ae0d-37b93d9a7d79", "sighting_of_ref": "indicator--5c49b94a-b6f2-4df1-9b14-54ff0b3e4956", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8749cb0-04aa-4248-b25b-008c98b368a3", "sighting_of_ref": "indicator--3b560448-253c-4668-a971-20b9c5bc368a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a92b57c2-47f9-4175-a972-4003e0d50ba6", "sighting_of_ref": "indicator--c51e7334-695d-4460-8e44-5bcd253bad21", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ac3c970-0c88-4734-b7c4-490003dcdb9b", "sighting_of_ref": "indicator--8893a8d9-0000-4300-960c-35a71df1fdd7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e12b3bf9-fda6-4676-aa2a-988587823da6", "sighting_of_ref": "indicator--20897e30-cfe1-498a-83ec-0393bb20c55a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc2eeb6b-4af4-489a-b4c0-aef8f314072a", "sighting_of_ref": "indicator--38f20db3-f368-43c6-b335-fc9c61b74dcd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d75b4b-cf27-4b27-a57a-9301af0bce91", "sighting_of_ref": "indicator--61f924b6-e7f6-4cb8-b80a-467b0f00a960", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b18426f0-fdb1-4476-89b2-7a0daca16401", "sighting_of_ref": "indicator--fd133fcc-d577-4d2b-a4a5-b2cba6e18e1c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74154d13-bd6f-4875-8a12-07eaccfce910", "sighting_of_ref": "indicator--a7e67842-8134-4400-83ab-2f14f4bfd364", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6a9594-c2e8-4d77-89d2-349b78198b65", "sighting_of_ref": "indicator--5974c8a5-5762-41c0-b294-2cbec157bf94", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1398d95-8254-4a7f-b4e3-187b610dd893", "sighting_of_ref": "indicator--3c2e6b50-9d49-43c0-8484-0ab396d98bdf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9ac5ebb-032f-4356-8125-f335e7a7497b", "sighting_of_ref": "indicator--e97fb2a8-9534-434b-a331-0b78df470f50", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75c54ec-70f7-4d66-aad4-5a5896b12779", "sighting_of_ref": "indicator--056fb2b8-ad65-4212-a089-378ad3472f10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4aac345-3d51-48f5-bcd8-b247d5e96e7c", "sighting_of_ref": "indicator--7814a03f-3e4e-4f27-8938-06bef554928d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4865f47b-7c2b-4e79-a81a-7fcf631dfff5", "sighting_of_ref": "indicator--2e012ffe-6122-4ccf-be4f-c99b91178a3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19900b6d-5d4f-461e-a326-cce4e9437fb9", "sighting_of_ref": "indicator--fce16691-041d-4419-b920-0082b55ed97f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94df0196-0e9b-47cf-a203-1599e3a97a9f", "sighting_of_ref": "indicator--3734c2c7-b9ae-4558-96cb-3a42c26089f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf7eadae-70d3-4d46-b7f6-1443e903e3fe", "sighting_of_ref": "indicator--3f449e08-417d-4063-946d-863eadb4ae7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf52450-a0db-482f-8f6f-dc49a8b4cc10", "sighting_of_ref": "indicator--2db55f26-b635-4398-8327-c9e0d94acd59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d46527-7632-40a8-a72f-3bfdd12a0025", "sighting_of_ref": "indicator--5f2cbd02-a47d-491d-bbf0-39ba170896c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e08655e-f579-412c-89e3-03a303fed444", "sighting_of_ref": "indicator--e379147d-bae9-407a-9d98-424c887d84d0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3761814c-7f34-401e-8eeb-5f3c492988ab", "sighting_of_ref": "indicator--a95bd803-a69e-456d-b70b-c8299ced148a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce692abb-9e82-4ba9-8cf4-0cde36a2e53c", "sighting_of_ref": "indicator--67449644-8946-49a4-9a74-ade87e29eeca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5a350fe-c3a9-446e-ac9c-b0f092724efd", "sighting_of_ref": "indicator--629af1d2-19d0-4f6e-b326-a8d548a78045", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8796e2fa-00d7-4317-95e2-b0a57beefd11", "sighting_of_ref": "indicator--aace36b3-5d89-4b78-86f5-212bfac0e7ed", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ffab4d2-ad7e-496e-a233-4e18720e12ff", "sighting_of_ref": "indicator--216d3f93-49c7-49ef-a7f5-5f5f8bde83c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8242a79-a1de-41e4-b694-6e1a61eb3865", "sighting_of_ref": "indicator--409dcd04-1598-42ee-8549-56566c6b462c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8665da34-b995-4561-b4f3-87a1bad7bc1e", "sighting_of_ref": "indicator--7a01832c-0bbc-4247-b74e-9bb4cc40e815", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6dc59d5-adec-4a9f-aa2e-ac86e6976470", "sighting_of_ref": "indicator--6b6ce096-8333-4faf-bc2c-de430cc366e0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32f6702d-f20b-4159-982c-c0a4059a3b13", "sighting_of_ref": "indicator--32a6fc2d-67f4-4b8b-8b7b-3c95bbca1f9d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2cd9385-2cd8-43c1-b88e-96c6bc6a76b0", "sighting_of_ref": "indicator--92f56725-f91c-4d8b-8f26-fa153982eb6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4997fcb3-897e-4ffd-8c63-ebf5f2c8c146", "sighting_of_ref": "indicator--4851199c-85a8-468b-95c0-1c311fa0c8c5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db8f38c4-7b01-4842-b472-8ccf0d69f8d5", "sighting_of_ref": "indicator--037abe04-d3d0-4ee1-89f1-a29856c127d5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8032684-4f67-443b-9e3a-cdf50c6c7f6e", "sighting_of_ref": "indicator--f8bc633f-dc03-4c35-a5da-2010518d304a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--088bd919-3853-4dbd-83e5-e515d8632c88", "sighting_of_ref": "indicator--8bc4d4a6-29ef-4d9f-b1cc-6f15d5581500", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f06f636-b30c-4d44-9a4c-e593cc59b954", "sighting_of_ref": "indicator--ae4e6ac5-f44a-4f0e-bac5-772f8c1c9c90", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0d7daad-a1bb-4bbc-85a7-426db2c4ff87", "sighting_of_ref": "indicator--5d0af5d5-a256-48e7-9a5d-f14786afcd10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--545d03f0-b842-4008-8255-6c513b7eaee6", "sighting_of_ref": "indicator--f71bebdf-2092-4b25-964f-6d3c2d94a878", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b00844e1-d467-4bd5-a171-67beb0a768d5", "sighting_of_ref": "indicator--817398ee-8eb2-47dc-94bc-2a7e97b908b6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--866116bf-0408-40fe-840c-af0021cc700e", "sighting_of_ref": "indicator--94f6045b-eae0-41c0-b9dc-a17f5cc58161", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4999642-e1e4-4bbb-937f-a686d27ad028", "sighting_of_ref": "indicator--1576a5c0-5b7b-4a6f-ad06-c45be6123659", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c51988f-2b10-452d-b376-4412c15bdb9a", "sighting_of_ref": "indicator--b6af88a1-b188-45a2-a343-524daeeed4fc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8461966-bd07-4296-a700-e19fb8dd6cdb", "sighting_of_ref": "indicator--1351a01a-b176-48d5-9789-6249df4f0c05", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76267fa-5c7c-4b9b-8a0f-4a14e00418e4", "sighting_of_ref": "indicator--dfa03b09-f280-4d7b-87b7-028a9a1c4287", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca037d2d-8a78-4810-8304-1635c9c844f4", "sighting_of_ref": "indicator--1d9cffb5-0ba2-4c18-a86d-2d0d21502014", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edf8c19a-a368-4ff6-b2c4-38297437904d", "sighting_of_ref": "indicator--2e95d151-583b-4a8d-aec0-5e51919db572", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172e9f94-3328-4d98-a843-f2ec21c030b7", "sighting_of_ref": "indicator--fb7d540c-9412-45cf-ab16-7d5339df3cba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdcb4992-f27f-4876-92c7-6496192f629b", "sighting_of_ref": "indicator--b39f3842-a3c5-442d-9179-ee52ee2cab67", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--587c6a94-2d77-4170-8f37-df15514a3b3d", "sighting_of_ref": "indicator--740dc0a9-a54f-442c-b431-78a89df13a8d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbbe5d0e-89ef-4972-8152-99a532c15d3f", "sighting_of_ref": "indicator--f5ca5713-b7b0-4858-915f-f9c782ec805a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1c33b39-b24c-4de2-9f3c-ab0e7710de2b", "sighting_of_ref": "indicator--b0e3732b-a8b8-45b9-9eaa-2b9e8dc06e89", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0afaf4c8-3bd1-464f-883a-80ea5b54374e", "sighting_of_ref": "indicator--7f63467a-fc5c-46b4-9195-fb3861b08747", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d13da36-e40f-43d9-91c6-8d7422f0e3cd", "sighting_of_ref": "indicator--ba14fafc-8304-49e3-b1f8-cfcab5c5c6f6", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--687985b4-0bed-455c-8d19-3ce3fa7bfd49", "sighting_of_ref": "indicator--424163d4-9231-4376-97c3-c10e820849f5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6d193b-5e02-4842-b2e9-5f6dfdc1caa9", "sighting_of_ref": "indicator--a212c294-7e8c-49d1-a004-f3d2e0bf8710", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--526e1f77-f6a5-494c-8473-4036652851de", "sighting_of_ref": "indicator--8adf7c3e-b93d-4110-8b10-9b19ce80763f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53a68b0-b92d-499b-a9c1-2000d1fa1dfe", "sighting_of_ref": "indicator--5693e939-88e5-43e8-bd6b-4dd8db1f0c78", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9ef93e-9958-44c6-84bc-0a65d9d29cfc", "sighting_of_ref": "indicator--1399509e-2afa-4dc4-877d-488e80b7dbf2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb205dbc-1cf7-4030-b0f8-d362603054e9", "sighting_of_ref": "indicator--a12dc20f-c135-43ca-98c5-d04dffb05e8a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2ec2723-26ec-403e-93ce-cf598bb6b8f9", "sighting_of_ref": "indicator--18a8c46d-e930-4b33-934c-c56b121e1d28", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88fe0c2c-c893-4f69-8461-5a7164b911c7", "sighting_of_ref": "indicator--1f023b68-2616-4c5e-bdad-c17328c82b3e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d3eb705-76ea-4f56-8b25-213984598136", "sighting_of_ref": "indicator--94b95301-48fd-49a7-b5b9-128472bc9763", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e9dcb84-88cb-4ebe-b36f-bddb5a0de4de", "sighting_of_ref": "indicator--99e91b79-0783-4594-afed-16c57cb0c3c6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c3b3b5-d26f-4b27-a733-641d3972a564", "sighting_of_ref": "indicator--4df6b354-c051-44dd-80e5-56c44f078f3b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4d6bac1-17e2-450c-af28-4c0d532e96e8", "sighting_of_ref": "indicator--e0b2a6c7-1619-4722-95d2-e72971443820", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bdfb298-eda4-4b55-937a-60864e9dd471", "sighting_of_ref": "indicator--8e932782-748e-48c4-8884-95e16b5fd66d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9973715-75ce-4255-9099-fabc27c90a79", "sighting_of_ref": "indicator--0ed86070-bbf9-41de-bc45-7978ff15c258", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b30bbb-860c-494b-b65c-fbe962f7d274", "sighting_of_ref": "indicator--7c920c3b-ec5b-421f-82e2-07f610971e84", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a59f2b56-ae0b-46ad-8012-ab2e43476920", "sighting_of_ref": "indicator--a6abbc48-33f1-4bef-8046-f334e9222837", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b368e1a-663a-4201-ad76-553187b7d918", "sighting_of_ref": "indicator--cb7246d9-7b86-4107-b8c7-e0be9534782e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5686eb75-6809-4dd2-b24a-e1ab04bc7593", "sighting_of_ref": "indicator--43dfc341-c575-4060-b7ec-519f60423d17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb30167-a40a-431f-8bf3-81792e434f26", "sighting_of_ref": "indicator--238b3daf-04a8-46ea-9acf-2c1bb6710212", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cd7ff55-e85d-4303-86fd-0293e5e7c231", "sighting_of_ref": "indicator--5f801883-c7de-42ea-9187-682114244556", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaa305b4-c4f6-481e-848a-b7e224b7fb75", "sighting_of_ref": "indicator--362e3c0a-0587-4a7a-ab53-c119e29f563d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dfe44ce-0948-4c0b-9eba-3728ec6abd47", "sighting_of_ref": "indicator--3f68d266-30cf-4e63-ab76-728c524a72fa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7283c9-4057-430a-92e5-f214748d7367", "sighting_of_ref": "indicator--c2da0e03-dedd-424c-b719-f568648e5b9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--289c5a96-e79d-43df-9fc7-9db24110f892", "sighting_of_ref": "indicator--954640a3-7775-41df-acc9-98c4da74dde9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58e2af49-d9e4-4807-9d5b-be431b050163", "sighting_of_ref": "indicator--bc37e5bb-460e-45cb-ad4a-0248de961e52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac40b7d9-547f-4e0b-9497-4a556c67041b", "sighting_of_ref": "indicator--e17b80dc-69c9-4766-aa8a-6daf8a717ac6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f2032e-2bbd-4aac-bee2-e1f5637e7bf4", "sighting_of_ref": "indicator--9b555038-4fda-473b-aa60-5af45b62b718", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a137cd4-5d28-41b8-b4f8-cfda0fd3b1b2", "sighting_of_ref": "indicator--fdcaeccc-321a-44d3-80ab-aeadf262895b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e047055e-766f-47aa-ac47-83e024a40960", "sighting_of_ref": "indicator--ca7f8928-f322-457a-b46d-f4e4b146eeb9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd305e79-918b-4384-8652-f20de562295e", "sighting_of_ref": "indicator--6abc1dec-8ae1-44aa-b398-a34632165574", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--019e7827-dc68-4896-9e3e-9f75ecd26688", "sighting_of_ref": "indicator--377e3983-ba41-4f83-ba6c-0aadf436264b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c459117c-f64f-4c9b-980e-692290f7db6a", "sighting_of_ref": "indicator--04bc50f6-a4d5-420a-b601-7a3a954e4ec3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a81edf8c-2d95-4523-9070-b2f3e676bf16", "sighting_of_ref": "indicator--047abd41-7d87-4614-bafa-15a8a9971cae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f59203-0a9d-4683-a8fc-564d8a6c757d", "sighting_of_ref": "indicator--b709158c-62f1-415b-9be6-c6e65faa1176", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1aac7fc7-1bbd-4086-a726-849abf3c2b97", "sighting_of_ref": "indicator--76259076-df66-4f90-bb6e-f9c3344427d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--103a9413-74fe-41cd-8793-85762205ca3f", "sighting_of_ref": "indicator--e6bbac84-d359-41ff-a367-aaa379b09cd6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24e2e5ae-2423-4362-a48e-e3003f19e0a3", "sighting_of_ref": "indicator--df0f4c60-af26-4cc9-863d-ac4618a52265", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87a61464-59e5-45b8-bbb5-7e8e6caa6a07", "sighting_of_ref": "indicator--9ecb531b-62b5-45e6-b54d-4b20717a6ccd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb1aec8f-f365-4ba6-8ac7-b53ddb37abec", "sighting_of_ref": "indicator--35e53e6d-5a9a-4074-95e3-296307c4da68", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f81bcde-c28b-4e59-ae0a-f87fc1348e48", "sighting_of_ref": "indicator--23f725f5-5ad7-459c-836e-effe61aebd95", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--072b1580-692c-491c-bc96-06ec6d74545a", "sighting_of_ref": "indicator--0e3f655f-7753-4315-8c24-829188715cd9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e769ab5-86af-4b97-880e-e11b6a2895d5", "sighting_of_ref": "indicator--fba42301-2003-44fe-bfd3-8d290ec48afd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4733055f-cdd0-4e95-9ad6-800e328dc856", "sighting_of_ref": "indicator--5c680b92-6229-4f2e-a75a-491217062d12", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c46d2247-7149-4c76-afbd-efd164983a3b", "sighting_of_ref": "indicator--775bc3cf-9bf1-4f7f-bd65-bc254b105e55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da0f47f2-1e44-40cd-8eb1-4cf8ef2e8b18", "sighting_of_ref": "indicator--7bb6fcec-ccd9-47d2-9dd9-48e06ec78d54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6abc0191-c671-40d0-8bc7-5175eb712630", "sighting_of_ref": "indicator--68bd091e-1e14-4c33-baeb-24939d4f67c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3d518a9-ebd2-4c65-bafc-3ce1d13c55bd", "sighting_of_ref": "indicator--c2eb167d-fc01-4b27-b28d-e933bfefbc74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2273c359-8127-4ea1-8d49-ec7acd0083e1", "sighting_of_ref": "indicator--56b5632d-9082-48f8-9f36-c159124d81cd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d00981-21fd-4341-9961-f698a0bb712d", "sighting_of_ref": "indicator--b779a473-f908-4006-8ddb-a05c689cf4b2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--049fc25d-e577-4f14-ace4-c733c3cd8ccd", "sighting_of_ref": "indicator--873f2e6b-c29c-4f49-9ec3-6dd428829c9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f21be00-a82a-4569-b729-5f134b1596f9", "sighting_of_ref": "indicator--71c5da7f-78e0-4c97-8cac-90cc3082c1d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bb608ae-7db8-46e0-b187-d0939b6c76cd", "sighting_of_ref": "indicator--6d308dbb-e255-485d-bcd8-de1a3db21785", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb57d91-f348-4706-867b-4575497c01e5", "sighting_of_ref": "indicator--291f1e30-bb96-4391-9559-07385d2abfbe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15ad160f-e726-41b8-a622-4544cbcad3b7", "sighting_of_ref": "indicator--71f42f93-6c48-4d2b-b97d-67c99f695bad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53086206-e7ed-4f92-9a1a-96072b598fe0", "sighting_of_ref": "indicator--3ee48e8d-a786-4ce7-b54d-a5ab1104547b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ce1f480-1069-415a-805b-7ce45cd965b0", "sighting_of_ref": "indicator--4b583bef-c9a2-439a-9962-6acbb51bb0d4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--659fd6c3-e8c7-4c57-8c7c-302635c84bea", "sighting_of_ref": "indicator--34feb955-65e8-41fc-8a78-a8005df087e9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc0b62a9-24ec-4226-bf24-35582ff0a2a3", "sighting_of_ref": "indicator--3da41ac8-4aae-4c9f-8364-ee2882b22819", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d70be96-d32c-4d41-a1d4-59d6c22702ae", "sighting_of_ref": "indicator--7f25d2b3-3db6-4a77-9e3a-15c45eb20aa5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a03b694b-6324-4073-b22b-f536c4a43f71", "sighting_of_ref": "indicator--d13d4efe-d363-48ee-a80d-1109f8341108", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d3a734e-a6f3-4f9c-ae11-9f2e7aa01d94", "sighting_of_ref": "indicator--b5e90e37-31f3-4874-80e8-a44d32dbd1c1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28a606a8-e0bd-43bc-a06c-f4029f9f3969", "sighting_of_ref": "indicator--6f171e2e-66c5-4f5f-b739-74e58f8c490f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c634e62-9559-4259-b2f6-93407ff8921d", "sighting_of_ref": "indicator--53ac3179-2fdc-489e-b0b1-1d00750e2163", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eff5449-0c4f-4872-8b6a-7738d4d40baa", "sighting_of_ref": "indicator--6c3bba6d-af4b-4ad8-9da7-ccb015ea113f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a57e7a-4fcc-4b8e-a190-b8153f68e9ac", "sighting_of_ref": "indicator--c1d84880-d61d-4801-8f24-1d73034de492", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0595a805-e047-4643-9026-b2f02e218f46", "sighting_of_ref": "indicator--e73d887a-7c40-4a74-8f02-2d7858ff0be2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f46c77b1-42c0-47b3-99b0-51692108ce53", "sighting_of_ref": "indicator--fa7b6a6f-7da4-4417-9fb3-63ba09f43c0b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ff3d393-22da-4efd-93fb-9f4b19795da2", "sighting_of_ref": "indicator--f91035a6-c5ea-4cec-83e7-90682881cce6", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--426204a9-871e-470d-9cee-f562fbfc7b7e", "sighting_of_ref": "indicator--420b6975-fbae-4b92-9566-a304c4c53f04", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efdacd1f-9d3c-4525-815d-18540a81b093", "sighting_of_ref": "indicator--2f9796b2-d5c1-4a53-9451-68a730bf094f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddc9d560-3832-4fc2-ae13-8c0047d0e325", "sighting_of_ref": "indicator--68bd716a-17fe-49ba-b90a-874e9f1bef2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c5dc942-68d7-46a5-8c35-438286537199", "sighting_of_ref": "indicator--51aab9a7-494e-4e3b-b41b-0078498575b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4afe8e2-68a4-444b-a4cf-ab951e38f523", "sighting_of_ref": "indicator--2611be58-7635-45bb-9760-120042611b60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bb044a1-08d5-4e3e-8f78-87a354222ffd", "sighting_of_ref": "indicator--c1894710-de3c-42fc-b526-6556af5c93eb", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef29222c-04b4-4938-be13-ece0bc127a5e", "sighting_of_ref": "indicator--cbc8fd1b-3436-47a1-9577-703e4590fe8b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3094d827-c76e-4b10-970f-ac8a5bb722eb", "sighting_of_ref": "indicator--cffb3c5e-ff54-4cc6-8561-0966a642b6aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03be8bda-7135-4566-bc25-bb4512f7999a", "sighting_of_ref": "indicator--518bc588-7ede-4334-8fcc-aa538c679f8c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b679920-c414-4232-bf19-a11b0970b8cd", "sighting_of_ref": "indicator--8f515d20-4e85-48c9-a724-b6eb57d477cc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68d2c4fc-4837-44e4-a2ee-02074cdfba7d", "sighting_of_ref": "indicator--8f515d20-4e85-48c9-a724-b6eb57d477cc", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ea6cf5f-670d-4002-9ffd-feb4799f8217", "sighting_of_ref": "indicator--8f515d20-4e85-48c9-a724-b6eb57d477cc", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15a31a41-640a-4836-b32f-71e6fec269c7", "sighting_of_ref": "indicator--f02d7f53-bb5e-4990-af80-bc87bf374110", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d63381f7-ae91-4da2-ba23-1b01e2a37dba", "sighting_of_ref": "indicator--f02d7f53-bb5e-4990-af80-bc87bf374110", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc31305-cb4e-405b-8c4d-126ed9f7f776", "sighting_of_ref": "indicator--f02d7f53-bb5e-4990-af80-bc87bf374110", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--325d0a01-cfa1-48a2-9601-8d0f882629d2", "sighting_of_ref": "indicator--a17f4a64-1fc6-421f-8ddb-a41a140bb799", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a7a0c45-aef3-4068-9d8d-6fe65f16a96e", "sighting_of_ref": "indicator--a17f4a64-1fc6-421f-8ddb-a41a140bb799", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f871d3-ce9d-4000-a561-1e465461eeaf", "sighting_of_ref": "indicator--a17f4a64-1fc6-421f-8ddb-a41a140bb799", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7b93408-3369-4164-9de0-05333065c726", "sighting_of_ref": "indicator--995e095c-f32d-4fc1-986c-721905a0c2ad", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24c6e306-5289-43ef-9481-c6253d0421d3", "sighting_of_ref": "indicator--995e095c-f32d-4fc1-986c-721905a0c2ad", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad4e033-a6d8-4cd5-855f-3e2f5482d923", "sighting_of_ref": "indicator--995e095c-f32d-4fc1-986c-721905a0c2ad", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6a0ff8a-9b60-4142-9a63-b331f081f11b", "sighting_of_ref": "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9e4406-48e6-4859-8333-dd8316bb2c30", "sighting_of_ref": "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca5791a2-228e-40a3-8364-9e209ddd7239", "sighting_of_ref": "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d209ca4-32bf-4397-9995-1b3cb9a693a3", "sighting_of_ref": "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b163f20-3552-4b7a-b2f8-dec6b30568f2", "sighting_of_ref": "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11946d4d-5606-43f7-87f3-f061a27ad33d", "sighting_of_ref": "indicator--8e482c97-9853-4a9f-b1e7-66b1c10b6796", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1515bb3a-9921-4caf-b17d-0b74caf70dc5", "sighting_of_ref": "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--237d0d44-5594-49bc-a588-7bedb3dded38", "sighting_of_ref": "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b53b54e-0d52-4be4-b730-042cb856a3ee", "sighting_of_ref": "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07eff205-26e2-4ae4-a82b-1b5cb8076db5", "sighting_of_ref": "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50708716-d138-4a05-ab56-353ec8aea31f", "sighting_of_ref": "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc7afd13-8ff1-45eb-9a92-3a0859cf0d8b", "sighting_of_ref": "indicator--7d889144-7688-4dad-a27f-d477f64d6988", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25caa179-f4f3-434d-af9e-a4f1423db4c8", "sighting_of_ref": "indicator--7d889144-7688-4dad-a27f-d477f64d6988", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43f92a0-69df-4c6a-82bf-2d3797512863", "sighting_of_ref": "indicator--7d889144-7688-4dad-a27f-d477f64d6988", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447cb555-4a67-493d-9b64-e1a143d3f02a", "sighting_of_ref": "indicator--f433d181-1760-4276-8986-bdb8327cd285", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e11e174d-d8b3-4a47-8212-7f600852789d", "sighting_of_ref": "indicator--05627449-6a19-427f-84f8-d9a4a3e753ba", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2fbea47-0246-44ae-8f6e-6846573dfbe1", "sighting_of_ref": "indicator--05627449-6a19-427f-84f8-d9a4a3e753ba", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e18c8b2a-d30b-4023-983f-5981c42c41fb", "sighting_of_ref": "indicator--05627449-6a19-427f-84f8-d9a4a3e753ba", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89f115a7-69c0-435d-82eb-c8d2664ac1d2", "sighting_of_ref": "indicator--131fc844-472a-42d2-8649-161de7200ce9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e12f39c-fe1d-4cfc-93f0-4f038c277656", "sighting_of_ref": "indicator--011c5b96-f4b9-4f9f-a293-faf74c2eb24b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b22c7ac0-1ed7-4d52-83ae-7b72d6c446cd", "sighting_of_ref": "indicator--a839ce4d-9ace-47ec-8574-5e661075eba0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22845602-e07a-4483-aa3c-a57b7bc992c0", "sighting_of_ref": "indicator--c97bfbc4-8b24-4723-b12f-70d00ee07bb0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b335fde9-cb94-4594-92b6-710625608c29", "sighting_of_ref": "indicator--00457107-5c88-4dc6-86f0-cf35425f7c47", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a96e7ed-a1f6-4586-b9bf-ac075db7358f", "sighting_of_ref": "indicator--fcebe8f2-8b00-47ba-9000-0c8e77592e82", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b37c5dd3-1648-47e7-bb7f-a0b9192d9aee", "sighting_of_ref": "indicator--53e1cff6-88f1-48ed-beca-71a64484806a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8085c667-e83d-4953-afab-216a9f9feb40", "sighting_of_ref": "indicator--aaf199ab-41c7-4e15-a017-3860830c5a1a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f894e818-11cc-4c69-9afc-0076a3b1838d", "sighting_of_ref": "indicator--048d08db-8ecf-4f2e-be1f-d64963c07fec", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f49d4fb-3e07-4f19-b8bc-19b35bf197a9", "sighting_of_ref": "indicator--f7357b6a-8d7e-4377-9019-5283e2b2ec6a", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85bdb63a-b817-4e71-9174-02151a807c4e", "sighting_of_ref": "indicator--4201c441-8f18-40d7-93d0-88e6dabfb76d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b023930-42f7-4ba7-9e51-a4abec05b836", "sighting_of_ref": "indicator--4792ab96-e1dc-4f4c-b377-04788c92d53b", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98c02d99-d296-4d5a-9379-4fc46079720c", "sighting_of_ref": "indicator--cbee35e6-4611-454c-806a-c1547ed38ea0", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c7a692-f2f8-48db-a9dd-d9175c149fc1", "sighting_of_ref": "indicator--2d65ddd0-cb28-402c-9d45-de0ea9257715", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c22f5e30-0269-4963-b34c-a45cf4c373d5", "sighting_of_ref": "indicator--86dfdda3-dce8-44c5-854f-ac38b8db315f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5c84f87-771c-4e62-b4ac-5e03413fbbee", "sighting_of_ref": "indicator--d5b7551c-62f7-45fa-b302-e745eefde268", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f16773b-e367-4900-a565-900586c79ef3", "sighting_of_ref": "indicator--3e93da8c-e0aa-4a9d-94c3-8674e170f0f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a42eff-312b-4496-a9f5-70c1158200e8", "sighting_of_ref": "indicator--5b93d460-2409-4651-aecb-ba8bf7761aaf", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55aa8fa9-e445-4093-89ea-160419536765", "sighting_of_ref": "indicator--80c826a1-72cb-40b1-927a-71f2172a4e52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5ec865a-9f45-46e5-97d7-709453680020", "sighting_of_ref": "indicator--80c826a1-72cb-40b1-927a-71f2172a4e52", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ded13cee-66e5-4a42-9142-80fcca329c55", "sighting_of_ref": "indicator--d9256162-e132-4e9c-a820-e977c032930e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f54fe4e-4530-41c4-8377-b7e2f0c6e509", "sighting_of_ref": "indicator--de387b1d-ab81-4414-920c-c4c254218ac4", "where_sighted_refs": ["location--848f6519-0a94-44ca-90a9-b840f1def475"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdc60138-e9b1-444a-b146-f07bdd32e5ea", "sighting_of_ref": "indicator--f1df2999-f287-464d-9ed9-9cca56c8664a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abbb27fe-fd93-42a8-aedb-ce3a77f0e64c", "sighting_of_ref": "indicator--b16ba70f-b4c1-4545-b253-4b61baf8a301", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fb9a5b7-0496-40f9-afd7-887069e4f24f", "sighting_of_ref": "indicator--42d94d7e-1828-464c-9119-700fa0fe6255", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e61e338-ee06-4ddd-8168-0c2c7ec39471", "sighting_of_ref": "indicator--0b8ad4ef-9f0b-43ad-a8d6-be5ba87f8c5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60414f03-3e33-4e77-9054-85cbc2b4b979", "sighting_of_ref": "indicator--e2ffb6c5-0b46-4a80-9e42-da635b6f7419", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4621ac4c-0c26-49a0-bdb8-c49e50b9783d", "sighting_of_ref": "indicator--8d3820bb-f4e6-4835-87ba-a5bc48a1e99b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cacb61f-4ff8-4405-9c3a-509bddcf6545", "sighting_of_ref": "indicator--0e497f96-f94b-4a4a-862d-18464563685c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3749c6eb-06c3-4a2d-bbc4-fe5c5a0f4f85", "sighting_of_ref": "indicator--70657191-7cdd-4a26-843f-f7134f7371d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3d8b21b-eb7d-4678-9549-06fa13af39af", "sighting_of_ref": "indicator--9f0ed880-3b55-44e9-acae-b8fae4af423e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2810e62e-57c2-4c55-90be-740a622b4c45", "sighting_of_ref": "indicator--9e2d5682-ff78-4551-b943-98ecb1d274db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f3a9201-d8fc-40c4-beee-aad8d4de1706", "sighting_of_ref": "indicator--4a313c78-1ecf-463f-ad31-be9ead79bf16", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b122f8-5106-4367-9fca-52f87255552f", "sighting_of_ref": "indicator--13749521-1e1e-4c89-add3-186f7dd22253", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc44902-71e8-4f34-9a01-5654b9a0c071", "sighting_of_ref": "indicator--ad958c34-8ff9-4cf4-802f-cd9fc8762b56", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda3a880-5bc0-49fe-8a46-ab47b121d0f2", "sighting_of_ref": "indicator--494c3649-b2d4-4ec0-8a69-c075f4ae6f84", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b91d46bf-0be6-466c-a6a8-c98b8e91ab71", "sighting_of_ref": "indicator--104ab9db-6e6c-46db-a029-6a2c7a2b0e6f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71ef8ffd-8cd8-41a7-bed2-100ffa89bc6f", "sighting_of_ref": "indicator--e2c0a635-6ba7-4b9f-b0c0-66fe89fb5760", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60d4502b-f56a-4905-9f67-1f8e3b847958", "sighting_of_ref": "indicator--5eb0adba-143c-4644-84a0-e92f60705584", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80df7ac-e5c0-44d5-9c60-a3f0fdf4034c", "sighting_of_ref": "indicator--f12e1d0c-a806-4d04-bd57-132c35cbc9c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b1733a-e874-4380-b5f9-5f69e6c91968", "sighting_of_ref": "indicator--6eb4378f-92dd-47b3-905b-4c2e0df8cc9e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afab480e-fac7-4b18-9bd9-fe95a6377f51", "sighting_of_ref": "indicator--5a087729-f116-4611-99c1-f02d56a5ab9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb428bb-55f5-448e-af9a-95e5565604db", "sighting_of_ref": "indicator--9a578369-6069-4f52-8be2-09dfb62c4e1b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--515dd5b1-0728-4b90-b772-2c33c2d5e713", "sighting_of_ref": "indicator--cded2691-d4ff-4ba7-b5d5-299c5e887660", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8eca76e-35de-4696-8284-cf63f017a018", "sighting_of_ref": "indicator--2bc0c1ba-a478-43fb-bac6-494c6ff8b910", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--722a2103-fe94-450e-97f1-d69971e53a1b", "sighting_of_ref": "indicator--42951e15-a7c4-4e9b-b285-d173046eb5a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f1f3031-bfa4-48ac-970c-63c3151a292d", "sighting_of_ref": "indicator--b0b4fde8-0bb9-40eb-bb01-63292b6b34a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a8bcb4d-3614-4f06-a8cd-f8699ebf0b3b", "sighting_of_ref": "indicator--0b773506-6472-42ad-8874-fb0ea1dee530", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b200e8-9fe1-4545-a61c-56927040aa32", "sighting_of_ref": "indicator--24b5a12c-638e-4c4c-8236-4aae9a8ac833", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3d6fe9-9925-4aa6-afdc-023487f990ae", "sighting_of_ref": "indicator--6429f2f3-96b5-4fe1-9469-705d450f35d6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8de88750-d48c-4d75-8651-4e0a3dba47de", "sighting_of_ref": "indicator--ccd6b9db-7b4e-474d-9d62-38d3d4aa4e6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fd68d57-191d-4933-b51f-28c0282db7a1", "sighting_of_ref": "indicator--ea471d09-04e2-4603-9c74-cac2ce2987a2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a05cde6-7f07-48fe-a062-fc788ffd8ec6", "sighting_of_ref": "indicator--dad471e5-0731-4b19-bb69-82d389c9fdd9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--688ba1d6-031d-48e6-88d8-f68f81e762c9", "sighting_of_ref": "indicator--5608a1ef-f470-4507-aca1-ac524ddeddcf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e434206-9549-407b-9c06-333fd4ca0022", "sighting_of_ref": "indicator--0f6a390f-0dd7-46da-9ace-3acd0d8a8149", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e05d2ee5-0cb1-44a6-8a85-2c373d07f600", "sighting_of_ref": "indicator--b0e97509-51e1-407f-805b-9e64a7aa5fe5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5f8405e-5fe8-4e57-8155-91f8ced23776", "sighting_of_ref": "indicator--68f280fb-f511-4c0c-b167-5bf61b16d67d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22f0d470-1e70-4d6a-beaa-33a7285364de", "sighting_of_ref": "indicator--8065af6c-1c71-40c5-92ee-19b9876a8034", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa5c6e1-a036-4c58-80e0-63838bf6a3a7", "sighting_of_ref": "indicator--b0a57877-8851-443b-b57c-4477f18ea347", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--778b804f-9138-4f25-a7fd-e853a1e62261", "sighting_of_ref": "indicator--8fa4ca6b-a93b-47a7-8304-adaf28506d79", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60d63f8f-89d6-4fcf-b9e7-bde8856c29b1", "sighting_of_ref": "indicator--9b7b9ed8-b562-423c-a8e3-8a96221f08f9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9177cbc8-f1be-4845-ab49-edb04bff0add", "sighting_of_ref": "indicator--5d325e1b-e756-46a0-b333-951dae8bc303", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--222d3e04-bca4-43f9-bb45-f4981b605497", "sighting_of_ref": "indicator--78ca1e9a-d9e5-4b57-9001-4f1261bc227a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31d7bf2a-808b-46b3-827b-c8145fff1ba4", "sighting_of_ref": "indicator--0bcac9f3-a1e2-4f57-a58a-52757d184024", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c22576b-672d-4d32-9673-27107e191b96", "sighting_of_ref": "indicator--9e671ff3-572d-4dfc-9193-5bad02fb8edd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa1f39fa-2e12-4d9a-9d02-5ff508ee24cf", "sighting_of_ref": "indicator--51e69eb7-c8d0-4603-917f-da1e3d343342", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e3de5a-ae84-475f-8b4d-f9e415d43478", "sighting_of_ref": "indicator--161ecd48-e5ad-4f52-92e7-56f57c359ae1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736be180-84b6-4b7c-bd40-4d5098902da3", "sighting_of_ref": "indicator--669d0d3d-1c7b-4ea5-a3f2-506d42a696f8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b347a47b-253a-4206-9bb4-6d2f9c589553", "sighting_of_ref": "indicator--33f2e689-3e9a-4a5d-ae05-83e5b394f2c4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0218d85f-91ca-45f1-beff-23a4a3b8887a", "sighting_of_ref": "indicator--69f175b7-0768-4738-b817-37d75311ff65", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb740654-78d6-4c74-b9f8-354eec3a6a43", "sighting_of_ref": "indicator--643b9344-1dd1-4cac-a64c-0d3faa515db6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b29407d-8e2f-4cc7-bee2-f2a47aaf8ae9", "sighting_of_ref": "indicator--3f19c3d4-f464-4e08-a92c-4b53d14e8116", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fb0611c-16a1-4dcd-a0c6-6f0a4db2082b", "sighting_of_ref": "indicator--2b9c90fb-86b4-4412-9296-0d463ec3b053", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff823228-2b64-40ce-824b-bd3ffd0f3d59", "sighting_of_ref": "indicator--99b923d4-9444-46b7-9e34-ad9f6f15f935", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89dc98ea-d313-42b1-b78a-88188e1dbd7e", "sighting_of_ref": "indicator--7e472191-e2ba-4b71-9fd8-23174ffc2436", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec4e8e7-3c08-4e40-8fea-36d2f415a2d0", "sighting_of_ref": "indicator--19072a09-ece8-47a4-8f3a-0067e38035ca", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccaae97b-ee19-4110-ab2e-d71673e8f13d", "sighting_of_ref": "indicator--0e57ebad-64a4-4550-ab28-bfdf348de139", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2119d9d-b4d2-4287-a7b3-b4bcd3d433d3", "sighting_of_ref": "indicator--a341d770-3b0a-43b3-b086-ff936189f8ab", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f877a48f-5786-4d6f-b776-b0ca99562524", "sighting_of_ref": "indicator--63cdcc44-6eae-4cde-90fe-029248a597aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b74f1257-528e-4789-b93a-ce41859adfcb", "sighting_of_ref": "indicator--f93618af-20bf-4b39-9ab6-4479454f1dc8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--148bfc59-c714-48de-8387-0da9560f5ad2", "sighting_of_ref": "indicator--e25ac42a-a651-4bd6-bb30-d8d488cd086f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c05eeb5-0875-4efb-9313-5a7e5338a5ed", "sighting_of_ref": "indicator--91a29482-f183-424f-91d1-826480a0bd10", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1026f4d-7ab7-4815-be67-7f8f19ddc30f", "sighting_of_ref": "indicator--469bce43-306c-4cab-8232-822d6ca14cd2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e063e234-715f-4a53-a901-58fa4f3cabf9", "sighting_of_ref": "indicator--4357166a-fed2-4a42-8735-2de1a931eef6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad741dd-ff16-405d-8902-73693092c3f9", "sighting_of_ref": "indicator--298b10cd-61f4-41ca-9047-c5fda302adb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28917c25-1bf5-4368-ba0d-a47655319801", "sighting_of_ref": "indicator--d8f0e180-1726-4272-a966-bca8aebef694", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f541ab93-a8af-43c3-a456-c83d75a97e2b", "sighting_of_ref": "indicator--809a8b13-21d0-4318-81bc-892f096c2bb5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83e3fd41-28e3-460c-a543-03286f927b3d", "sighting_of_ref": "indicator--0ab8046d-a7b0-415c-bd39-29035736c70b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7667876-487d-4b81-a583-f33d5d20bc94", "sighting_of_ref": "indicator--98914aa0-4e44-468c-bac3-bbec131bdf57", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--219cb877-9114-4506-8291-e2aed4e1c9b9", "sighting_of_ref": "indicator--bb0ec427-0311-469a-836f-b61cdcc38cae", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d7dc98-ed1a-4088-bf29-141858b3bb71", "sighting_of_ref": "indicator--3f9b88bc-120e-4722-a358-f69031e9de4b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--209953de-65e1-4a92-bc6e-1582d013dba6", "sighting_of_ref": "indicator--f1e1cb98-7594-403c-9efa-b938834c4ba4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f18024-3a47-4019-b17d-9c08fd108e13", "sighting_of_ref": "indicator--51f43b59-9c1d-43f7-b8d0-27a355a2383e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb978bc-caf4-40e8-a014-28d6154d82ae", "sighting_of_ref": "indicator--6ec3037b-5143-4200-a199-c9cf4e7c79d3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a2eb85-ac5a-41d1-8c47-ea605974f0f5", "sighting_of_ref": "indicator--1e731469-33c2-4c5d-a633-1424363f2a46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ee576b-62aa-4291-9580-691e36c64fa7", "sighting_of_ref": "indicator--3fd1e136-ceba-498f-82aa-8d3cfbdc48fe", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5018e5f9-ed5c-42e6-8f99-2dcf71450513", "sighting_of_ref": "indicator--8abde826-d628-4dda-b1e0-f06a86e92954", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f0d42d-37d9-4fb3-8cf4-e28982669b21", "sighting_of_ref": "indicator--17577c63-56b4-442d-b8f6-39133b586212", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdcfef36-6d5b-47f3-88f4-2aa7307312e4", "sighting_of_ref": "indicator--fec0561c-ec77-40fe-99e2-7d307de00fc4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ced53f-a652-4a71-8f7e-32a71818f882", "sighting_of_ref": "indicator--57c4a487-9db4-4e15-ac77-7150f6cb49f6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee2d5065-0d39-4480-a80e-e8ea136bc613", "sighting_of_ref": "indicator--37172f04-62f4-480d-94f5-4574f35135e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6785f462-98a4-44e4-9098-11adb943cab8", "sighting_of_ref": "indicator--373f35f6-4e02-4720-93d6-730bbf6b4ca0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb406bf-819d-4373-8f35-0ee3a411062f", "sighting_of_ref": "indicator--7399e001-692a-4f72-9d2e-2c41dcb0de2c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ebe59f-d269-44ba-85d1-2495628b3e3c", "sighting_of_ref": "indicator--0bd2642b-2ed2-4ae4-a481-a539bc2811e6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96f1d4a2-c262-4bb5-98aa-d4c93fcead14", "sighting_of_ref": "indicator--63764917-60ac-4075-b2cb-705c57422940", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b16fa40-292d-4937-9f0c-416c154c3077", "sighting_of_ref": "indicator--963cf956-8f7f-40a3-8820-dbeae87f86ec", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1584fad-0eed-4610-b460-5cb810c977f3", "sighting_of_ref": "indicator--fa6d07b2-94a2-4657-91bc-da22f9d19bc7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f20f80-961f-47ab-a7e0-c255ea9c84d9", "sighting_of_ref": "indicator--63e78e78-d131-4efe-97f9-9ffdad4373be", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48208634-d9d9-462e-bb7d-3566178d3813", "sighting_of_ref": "indicator--34d1c56c-0e10-4d8e-8489-14c29e468276", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5116f272-a7ff-4bed-b5c7-58635b88a2bb", "sighting_of_ref": "indicator--2cd5d11e-5b65-4910-b54b-ec2990f3290c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9110bf6d-7085-4bdc-a53d-431a464a2866", "sighting_of_ref": "indicator--e4bdb660-636c-48d5-ad45-81416a89fb52", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e718f141-5f48-41fd-a9e5-9d625f9cc808", "sighting_of_ref": "indicator--b022d7d7-f842-4ab7-b771-0ec9844aefb4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee681d37-1b89-4214-8153-7744697c0071", "sighting_of_ref": "indicator--9a9e24b9-7bfe-4565-bef9-b7fd57aa2097", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a4aa99-5cbb-4291-bf76-0ece850f2851", "sighting_of_ref": "indicator--6f91f592-5b16-4b16-929b-be4aaeaec464", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90ba0f1-0114-4aff-a49a-b0a23c2295e6", "sighting_of_ref": "indicator--dee9d6ba-8211-405a-b4cc-4d0ad211847b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff90c658-d368-4f63-99a5-faba06319e45", "sighting_of_ref": "indicator--c6aafe75-a0c2-436e-8837-146d3c89c48d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12137857-f0a9-40db-9b6e-b1bccc9a0abd", "sighting_of_ref": "indicator--a7e21e5e-5648-4c2d-ba80-fc59ee0feb4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25c1c774-0648-496c-ae69-6c8f38a53d1a", "sighting_of_ref": "indicator--c8bf49c5-ad6a-4812-82ed-1f506c4bf806", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec13eb12-83ef-4b87-811f-6a9ae0a3fc8a", "sighting_of_ref": "indicator--9e3ac248-c05b-466e-8150-397fb394201b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca641e70-f301-4e03-9be2-586f4fad0555", "sighting_of_ref": "indicator--5c126abf-3e20-48fd-a89d-504c0b368791", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98aa98b8-894a-4f35-b29d-7af6e1c1853f", "sighting_of_ref": "indicator--415f2008-751f-42d0-9715-3995e4db8307", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aac5a6e-da1c-4edf-9e3c-f8b6138d666f", "sighting_of_ref": "indicator--bf7585c7-1c7b-4f81-93b9-e990df01b428", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99893d56-71a5-4e7a-aea1-81be4be25c33", "sighting_of_ref": "indicator--b2495b5f-0965-4da2-bd30-792ee93aada1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97a1581d-0485-4598-900b-0d9383b4868a", "sighting_of_ref": "indicator--898e19f6-99b1-456b-b916-3f514079f0c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a730a2c-704c-43e5-9229-a52ab41b8050", "sighting_of_ref": "indicator--e2974e08-23d5-4990-a937-52154138ed44", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec3fc93e-bb5a-453b-a272-677e903c1ca7", "sighting_of_ref": "indicator--8c3c20e2-d693-4223-a7bb-35d18007ea22", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60bfc7f-0781-4c9c-9b29-683083673250", "sighting_of_ref": "indicator--de5b8e0c-1fcf-4627-908d-f7f643181889", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0667ad7-e598-459c-ad3f-9abce5e85f0e", "sighting_of_ref": "indicator--d3572e76-050a-491e-94d8-14c920170a17", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--945ec999-45f8-45a3-8ccf-7d8e9a2e5bca", "sighting_of_ref": "indicator--f58b4024-49b9-4422-a8dc-8548426f1c18", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39dd744c-054a-4cf8-95e1-e6efa93cd2a2", "sighting_of_ref": "indicator--43130913-36e2-4c2e-ab7e-e08718d1b529", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0137911-fff5-4892-8cfa-c01cb9950cf1", "sighting_of_ref": "indicator--40f74eb8-b5fd-4cab-8eb8-466e2720bc46", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b54139c-a297-49af-8855-86aeef1d449f", "sighting_of_ref": "indicator--d6916c5c-3b08-4db2-b916-7da24fbeafe3", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf9b3779-e73d-4aa7-8a68-712b37d6eb48", "sighting_of_ref": "indicator--2f157428-8edd-4dec-bd43-67c6b324fc6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4c8823a-bd0a-4a5c-ab44-babde2c2b333", "sighting_of_ref": "indicator--7a6e48cf-4548-41c7-b77d-da7fa2ce4365", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52fd9dd-77f7-4d06-94c8-7639904d285e", "sighting_of_ref": "indicator--6a66496a-e331-4515-bd00-3f433b08d3c7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd400ce-30a9-471a-ac0c-b2941f0b5af7", "sighting_of_ref": "indicator--2ca976a7-8a4e-4e87-b577-f92bc30d3dfd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a56562f-6292-4269-9cb7-04c456a7f6c5", "sighting_of_ref": "indicator--0d1e1f09-2522-4dd9-b0d7-523fd30221a6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf93bc1-30e4-4b64-b0b3-61168853d2a6", "sighting_of_ref": "indicator--325df5dc-3666-4b5c-9fc7-4e89b22a54d2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f947aaf6-ae82-4cbc-89d8-02560131ab77", "sighting_of_ref": "indicator--e8d7f2cd-1314-479d-8575-cf61eecef06e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b086f654-55cb-4310-b25f-ebfc46e911f3", "sighting_of_ref": "indicator--7c785901-119b-4186-9add-239de4feb021", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb05ce82-c712-431a-af2e-349450d54e49", "sighting_of_ref": "indicator--dac3332f-f0a2-40f3-a703-b70428ab9ece", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da745a3c-07bd-4238-9bab-1892570f7ad0", "sighting_of_ref": "indicator--af3cdef3-5b52-4999-b98c-9c335280f114", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ed01646-b088-4bcd-82bd-c791434d2776", "sighting_of_ref": "indicator--251fa5d2-0f6d-485f-8ca6-a399432c0366", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bed9f74-c5f7-470b-b976-8bfb748a8425", "sighting_of_ref": "indicator--c2ab68cb-ab3f-4419-bb14-eb9fa829f947", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c31fec-4a1e-4362-ac58-e3310bc87603", "sighting_of_ref": "indicator--9e834151-08f2-40a8-a88b-552e4b27557b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7ea3b70-4c83-4cf0-b973-25b4b2d45739", "sighting_of_ref": "indicator--eaf67e66-420c-48a5-97d2-dab1bece2b1f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c550ef-5bc0-491d-ad9f-ec904f12d959", "sighting_of_ref": "indicator--a71625f1-d745-423d-bc74-f1fe2893ef9c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76688e7f-c0f9-414f-8446-db73472d0aef", "sighting_of_ref": "indicator--39b55695-2197-478d-b46c-ebc3a09eabff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a18343c-2ad4-4bc9-9f8a-6824c9a3c800", "sighting_of_ref": "indicator--71724db9-69ff-4c48-b35d-e8ea6f5e17c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b429e50a-2a38-477f-ae36-37ebb913272a", "sighting_of_ref": "indicator--2a24ce43-bbf9-4f8b-acb9-cf9a11dab63a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f23c0b-46f4-460b-8cd6-7d210ff5169a", "sighting_of_ref": "indicator--76cfc910-0210-475f-9cdd-a20ed858596e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd17f322-fd26-478e-90ea-893d25dff9ea", "sighting_of_ref": "indicator--2eb8ceb6-9566-4ea5-99b0-ec8df124df5b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954236f4-5f93-4d19-9ea9-ef7cf38eef89", "sighting_of_ref": "indicator--eed59830-5ff9-4c1f-b66a-83388e1937ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea527e42-6855-4564-ade8-0a133e0b298b", "sighting_of_ref": "indicator--372915d1-b9ea-4a92-b6d7-cd85b2e79cb0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d6d171b-ae8d-49c0-a40f-e4d1fe749e5c", "sighting_of_ref": "indicator--be7f329d-994e-428f-bd03-484f2bbe0cfc", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae97f596-3d93-4a0b-83ef-d733d4eccb7d", "sighting_of_ref": "indicator--6a8243b4-b235-4a5e-a0a2-a0d71b8a6c85", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dd7a8ce-c353-4a30-bf66-7f03bf1ceb1d", "sighting_of_ref": "indicator--a37ad82b-29cc-44b9-8dd4-a49e9a396d99", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c86ea4-8ec9-484a-a90f-d820c31bdf6b", "sighting_of_ref": "indicator--515f7661-4ec7-44c8-92db-5816e2b27924", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6dd0405-f5cb-4e37-9dcd-b9fa4919eda3", "sighting_of_ref": "indicator--8b7da4ba-07a6-4780-9aee-b937d5623308", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bfa140a-8001-4e57-8cce-b5c749e90de5", "sighting_of_ref": "indicator--ae9f27fa-2e2e-4c5b-988c-80801fb9007d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffa51104-88c9-41d2-990c-5bc440920bae", "sighting_of_ref": "indicator--c382f92e-34e1-4f26-b411-6e0ceec5aa3a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d0d24f-482d-48a4-8f8f-40fe19223bb5", "sighting_of_ref": "indicator--b2bef0e4-52a0-4dbb-a8f7-36eafa0ed537", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce19c763-067c-4b04-8fe7-67e7ddc7e0cd", "sighting_of_ref": "indicator--ea880680-7b77-4960-836c-0db33c2595e5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2f37297-5697-48ee-bcc5-f88f9e363e8d", "sighting_of_ref": "indicator--833a8756-6152-4037-9f17-723ce4e5cd54", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a65bb7-97d2-4aaa-b95b-1f5472a5c6d1", "sighting_of_ref": "indicator--623b2a8f-e89b-42ac-93d7-c84aac613c5a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb86c4d7-1475-4472-81b1-f72af0db09d2", "sighting_of_ref": "indicator--3af300d2-0526-4d89-9f6c-2e14ffb72890", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36bfe50e-2570-42c9-bffe-caf7649cbd9f", "sighting_of_ref": "indicator--bc65d902-5c55-428b-9501-78ee0495d5fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4149b90-3577-434c-b781-d7c8a6ef4527", "sighting_of_ref": "indicator--7d2a02b5-360c-43c4-be22-12873745b78c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7e05b9f-f842-44b9-b5ed-de17412d58c0", "sighting_of_ref": "indicator--b14a8d4b-4cd0-44e1-86de-db1bbfa817ff", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--437b9ca4-9856-4e9a-abe5-593dd53402fe", "sighting_of_ref": "indicator--5151354b-d56c-4535-a590-978f6257b26d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53bc96cf-0df6-49f7-bfc8-0d211caeba1a", "sighting_of_ref": "indicator--7012fe10-374f-4ca4-991e-a8f74d2cb00c", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf21e46-79f3-436e-8614-147417adceee", "sighting_of_ref": "indicator--9e80b3cd-1d8d-47f4-a00f-d422b5d375e2", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374ac9c9-8b1f-41e5-9d62-b39011b9b8c2", "sighting_of_ref": "indicator--aa2a480c-8abc-4cfb-84e4-211220129dbd", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--589b3fe4-b226-42c1-ba17-c2e7cb56f044", "sighting_of_ref": "indicator--df535b35-cd8c-48e7-9563-7dfb2d9cdee7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ef27531-d219-43b6-8e88-73dd821cc609", "sighting_of_ref": "indicator--509b23e1-fa6e-4869-8090-455f2014f848", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71568ced-708e-42da-844f-9fa17daba387", "sighting_of_ref": "indicator--1d8015bd-edfe-4684-bf22-79d8c3370148", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17689900-5a4e-46ee-a984-2fd8811d029d", "sighting_of_ref": "indicator--e9051e7e-bfec-47e6-9b83-4fd8b4d6b61c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87077d54-9b66-48f8-9fed-e551276c226d", "sighting_of_ref": "indicator--7112410c-7f5f-4d6d-9a93-2a90a943e1c8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4f33351-6428-486d-90f6-390b91eed07f", "sighting_of_ref": "indicator--706de1f1-02a8-4d47-9cad-f5990f416b1c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23e508a2-ad2a-4abd-962d-1fb852d584f9", "sighting_of_ref": "indicator--f88e70d3-e7fa-4d6f-908f-0f7242892329", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dea51c2-d801-451c-a46d-97a957c1ea77", "sighting_of_ref": "indicator--6f395587-3649-470f-9afa-94d150fe9c5f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdcea2fc-f1a5-4d0b-b168-5253253c3771", "sighting_of_ref": "indicator--222df7f0-000c-4709-bbd2-8dcc02efee51", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--206dea20-6f22-429f-9be6-02c8057c625c", "sighting_of_ref": "indicator--bd2d1259-f4f5-40f3-aaf1-7ac3781d141a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974eae20-eaab-4fe6-bb1b-926ca39311c7", "sighting_of_ref": "indicator--f13d7bee-e79a-4103-b0b0-28e9dd876e0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee4d3c67-77ac-4ec8-b08c-ab2e1831ab45", "sighting_of_ref": "indicator--02d9bb14-4ac4-4dcd-bcf6-7e751a78047b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51a0c60e-dba0-41da-938e-4231639d79d3", "sighting_of_ref": "indicator--fc8dadb6-25ff-4726-9112-3a44ce20fe1d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a55c36e-615f-4895-9eaa-68e764f8678c", "sighting_of_ref": "indicator--db346c90-1d4b-45a7-8f08-0b3f88bca13a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc5371e-c3a6-4d5d-9063-32f945effcde", "sighting_of_ref": "indicator--66fa010d-3653-4f61-865e-222860bb69b8", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc7dd412-cb86-45f3-96c8-cead5af42cfd", "sighting_of_ref": "indicator--e4fa4e9f-878a-4097-b428-dafe7229759f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--654dff76-e172-45a0-877f-244adc3d0adc", "sighting_of_ref": "indicator--9cba05d6-861f-444f-bc96-6165bca7b5b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf678a0-b11c-4c2d-918f-173c1169fce8", "sighting_of_ref": "indicator--5b11e8f6-f007-437e-b340-44d951b59faa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7107d7a-8ab9-4cf8-84bd-cb32e1d6dfbe", "sighting_of_ref": "indicator--60d5de46-0edc-4059-ab6c-03e470971f0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d1f9d4d-a54d-41cd-b1d1-6bcedaad082f", "sighting_of_ref": "indicator--a7e127c8-0d73-402c-a12d-b43d3fa6b460", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0875b5a8-0cf6-4102-b06d-16d907c187a9", "sighting_of_ref": "indicator--e1a3030d-ea37-46be-b02a-1035d91557b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa11af9d-4dff-45f4-baf9-8da607341859", "sighting_of_ref": "indicator--5995f4f7-9da8-4f4d-a31f-386b2871ee74", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9284b8b-e234-4fbf-98c3-53772d70ab7e", "sighting_of_ref": "indicator--11a0cb8e-a95e-41c7-84c7-b25775a69c45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fe1a97-c266-4719-b796-86a4f23710ab", "sighting_of_ref": "indicator--10a024b7-14bc-4b7c-b2d3-2c440d88bed6", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edaa6902-8978-4280-8002-915192d928c1", "sighting_of_ref": "indicator--626592fb-d718-430a-b13f-478e15ba8f0f", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7357a1ac-642c-46a2-accd-36b03302ccba", "sighting_of_ref": "indicator--7569d898-39af-4d6f-bc70-c1dbf3e6b184", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26385876-994b-4bb1-82a5-5ec6e51e2eaa", "sighting_of_ref": "indicator--a7f819a7-8fad-4361-912d-624f8d66f464", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--102a403a-9625-48a9-af34-8c8fcba7da8a", "sighting_of_ref": "indicator--daa84efd-7f27-4e68-863f-d58872e930d1", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--153c9664-d015-4330-99e7-b4a28dc24a4b", "sighting_of_ref": "indicator--ac57d3d4-b792-4623-8af0-0670229bf936", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--741dfc5c-602e-4fb9-b8a7-1316c6812f57", "sighting_of_ref": "indicator--213ef3f2-655e-4247-9886-0657aec955ea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36d8fc6b-a1f8-4d9f-9dc2-cfcd69322487", "sighting_of_ref": "indicator--a9625244-bb2c-4a40-beba-fbf8d03e8ce7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54c27a1c-f8aa-4550-8d0a-eb5e39eafe07", "sighting_of_ref": "indicator--a29328da-73dd-4832-b390-351f1facda88", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44b5b2b7-4029-4a4f-aa23-b1055e37ccd9", "sighting_of_ref": "indicator--60ae118b-eec2-42f0-92b7-291837d9e590", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3453e88b-2e46-4bf2-a42e-61bc96584340", "sighting_of_ref": "indicator--beaba7cb-d129-4bcd-8849-94f04bd853b0", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5da7077a-5c1c-4ca2-802f-ff0631b474cf", "sighting_of_ref": "indicator--3653c771-1da0-4d31-9fc3-f5e7a3254171", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a7d2f77-bc0e-4c32-a498-f1a724f89bc2", "sighting_of_ref": "indicator--b03b59c0-35f3-411f-8d46-68e57fb52a55", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd9b5599-5d07-44c7-92b9-9e15e057a0d9", "sighting_of_ref": "indicator--cfa8cbc1-1a7c-4b10-a8fe-91ab6e7b1942", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd9feea1-38f2-4603-9c6c-4385a9b80afd", "sighting_of_ref": "indicator--4735c94a-6428-4f7e-8a55-43c8d5507047", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50d168f5-77d1-43e5-8b36-0de42818dee9", "sighting_of_ref": "indicator--538ab1aa-255c-4334-b294-6179e9848f87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31329d6-73f6-4fa8-94cf-38e1bba09923", "sighting_of_ref": "indicator--06dfc4c1-e929-4b79-88fa-e8c6c84b8865", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c92541b-4ca4-4c7c-9b8d-5876f7196296", "sighting_of_ref": "indicator--1b6c18df-a19d-4b3b-b5f2-620067224490", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47cbd39-ef83-4b2a-948a-3147b43a8348", "sighting_of_ref": "indicator--489b9180-b13f-4420-838e-5abacf0ebfa5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52614f46-3e2f-44dd-809d-922c353e5f82", "sighting_of_ref": "indicator--f53bb6f3-c886-416b-af37-41de66903587", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3705b1cb-cc6b-43bf-83d9-6986938e133a", "sighting_of_ref": "indicator--e54876e4-40b5-4ead-8f5a-2262969525c9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e611f8b3-a126-4188-abff-98bd06cfcff1", "sighting_of_ref": "indicator--a6841f4a-9b6e-4e12-a4ee-82d3c95037d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--801ca986-9000-4c9b-ba6e-8f099fbee2a3", "sighting_of_ref": "indicator--ae4dd2fe-756c-40a4-a489-15fb958f306b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--380b937d-56fd-46fa-9926-460e261f74b9", "sighting_of_ref": "indicator--654625ef-644a-427e-8cc5-a50c43aaae7a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdea2162-82e9-42d2-bd4e-11894bbe3109", "sighting_of_ref": "indicator--a6cf163e-6310-4c4a-9b45-6d04ac7cf083", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62994998-730e-438f-abbf-f4598b7372d2", "sighting_of_ref": "indicator--a6ca8aa6-dcc4-450a-9ec9-7c70453d13b7", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--649024a6-14f9-4c12-99d2-87520ff73de1", "sighting_of_ref": "indicator--ff43a927-dde9-4bf0-a642-809a1b8437b4", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7889007c-e3e5-4dd0-8ceb-625624966b24", "sighting_of_ref": "indicator--f8468041-cd35-407d-ba10-00e86da9ca3b", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c759f2dc-cd09-4d12-91f6-e9870583f466", "sighting_of_ref": "indicator--550d9d1b-318c-4e6c-a550-96f79f6f2511", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1e99108-a671-4bd9-84e5-090769488512", "sighting_of_ref": "indicator--9cf4c9de-9b93-4144-87f7-1ac04f70ff9e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea865e2b-e569-48e0-a10b-c7c164c9aafa", "sighting_of_ref": "indicator--9cf4c9de-9b93-4144-87f7-1ac04f70ff9e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d01f54b-9bba-4d78-80e6-94bdfb96404d", "sighting_of_ref": "indicator--9cf4c9de-9b93-4144-87f7-1ac04f70ff9e", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaeabacd-d46c-47ff-a8f1-b0d4c21c9e79", "sighting_of_ref": "indicator--b2bc3256-b90c-49d3-8e62-62fc2eba0b0d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5634e243-8bab-4720-aa5a-800b9fc00c11", "sighting_of_ref": "indicator--b2bc3256-b90c-49d3-8e62-62fc2eba0b0d", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--010ef748-7e62-4801-a10b-ab5d18faa8c3", "sighting_of_ref": "indicator--b2bc3256-b90c-49d3-8e62-62fc2eba0b0d", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86376f3a-f7d9-4abc-a102-ac63ca7fab55", "sighting_of_ref": "indicator--16111b53-8474-4244-abd1-cb7b202eb683", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffa98778-7eee-4cbf-848f-7eb88f1d5e73", "sighting_of_ref": "indicator--16111b53-8474-4244-abd1-cb7b202eb683", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e998194-d040-47a0-822d-2d9999631859", "sighting_of_ref": "indicator--16111b53-8474-4244-abd1-cb7b202eb683", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acbfc5e0-5f22-440a-a43e-43d225d8e711", "sighting_of_ref": "indicator--11ee0614-048c-4dab-bfa0-a476263a662e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--982bc497-1cf4-4449-9173-14b872a7e5c5", "sighting_of_ref": "indicator--11ee0614-048c-4dab-bfa0-a476263a662e", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a946f2f-9f6c-4fd8-87b5-0e213c93a373", "sighting_of_ref": "indicator--11ee0614-048c-4dab-bfa0-a476263a662e", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad79f138-1f92-46b6-8c1b-9abfd5c17dcc", "sighting_of_ref": "indicator--4d803fe0-21f1-4b9b-a5c8-a9ced0337908", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcc01854-f943-4344-a967-5225c88e2822", "sighting_of_ref": "indicator--4d803fe0-21f1-4b9b-a5c8-a9ced0337908", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a431bb97-d78c-4659-803a-74ff3ca2d6df", "sighting_of_ref": "indicator--4d803fe0-21f1-4b9b-a5c8-a9ced0337908", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a2b0f5-b7af-4a97-a827-68afcca4b783", "sighting_of_ref": "indicator--c9ba219a-7d3f-495c-bc3a-d5cbc5aa3dbb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--332c1428-4c8a-4fd9-893c-e4e7912eeecc", "sighting_of_ref": "indicator--499190f6-ef16-4e6c-a732-f31ad8d168ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ad763c-281f-4856-af2f-1fccc1d5b451", "sighting_of_ref": "indicator--e9063252-ea3c-4850-ac4c-b6ff5b7da60f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--761443b9-e425-446f-96be-be784547cc6e", "sighting_of_ref": "indicator--42a07f4e-00f0-41a9-b7e9-45bb5a8778ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30ae03c1-75b0-41f6-94c0-6fdc9592970b", "sighting_of_ref": "indicator--1707eed1-75d2-4ff0-90c1-48af8d482f04", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53e67ac0-d846-497f-aecc-43e9466fc0f6", "sighting_of_ref": "indicator--9d1dbd31-5184-496a-815d-f9777658dafc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da1c3ee6-e3b3-47b0-a13e-03a94040659b", "sighting_of_ref": "indicator--b65d0a7e-c482-477a-8d31-22279d0436b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec2d6154-f781-4914-89e6-4f308f1abb6a", "sighting_of_ref": "indicator--ad47b9fc-c8f7-4bf9-88c1-f2410513ec3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff107b11-2aba-43c2-a30c-6ca53472522a", "sighting_of_ref": "indicator--2cad77fc-2bfe-4e42-a7b9-ff3382860a68", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f64a21-5d6c-4899-9884-33483b063371", "sighting_of_ref": "indicator--cb0e84ef-729c-48a9-8842-8fc8f0c7923d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d98c1ae-d1f0-46b9-a8d8-d026e932933f", "sighting_of_ref": "indicator--f043610b-b6a4-41db-aca5-1baaa905c93a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3e39efa-cc6c-4cb5-9c51-0165fbb778d2", "sighting_of_ref": "indicator--1dbc2dd4-1c91-4e11-a278-60c9c3bd8fc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ead24a6-57bb-4772-a98d-b6d7007b1aef", "sighting_of_ref": "indicator--804abef6-b26a-4683-8656-45a427259edf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d5ea1d-ec0f-41dc-ba4c-cdb758062493", "sighting_of_ref": "indicator--99614d30-a674-4a1a-8ddd-bdd663272e77", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31215505-2dd9-4199-a8d5-9b3e151c13f7", "sighting_of_ref": "indicator--c0a446a9-b3bc-49a4-966e-39de48e17ea3", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c75dada-a437-4374-9c42-a0afb5a04c27", "sighting_of_ref": "indicator--e59eb2d9-4728-4418-a4f1-785d6fbd4226", "where_sighted_refs": ["location--dc0f6a58-47f1-4531-b6e5-09f55c320471"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f12d054f-23e9-4db2-b9c1-f3aa0cda826b", "sighting_of_ref": "indicator--49f728bc-9113-4c77-87f0-edc22c2830aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ad645a-d53c-4072-8bd9-d34bdee10acf", "sighting_of_ref": "indicator--e9cecef5-92f0-44da-8d5a-22fc3a474e87", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb61b88-ffa8-482b-9540-f58fca570da3", "sighting_of_ref": "indicator--e0d76e70-1c36-4f37-ac05-59a910cf7f27", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1717bb8e-104b-4e82-b2e3-ece2e88ad265", "sighting_of_ref": "indicator--b7102e81-4e44-4d38-8ff0-8961735877cf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb421e0-a771-44a4-8f8e-b7d3e5537f67", "sighting_of_ref": "indicator--8f26285b-c380-49c6-9275-915118c4ad61", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9100dd-cb56-4261-8bef-3fa9003774ca", "sighting_of_ref": "indicator--ea76c25d-a5e9-48e5-858f-a4fb42ce04d8", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee04f243-3701-4113-96a1-ad8a8f4e30ac", "sighting_of_ref": "indicator--1cf5554a-3002-4cd2-a4c0-c2e82da3fbac", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a35ad691-202d-46e5-bd76-2f2430a15400", "sighting_of_ref": "indicator--a519e729-9755-47ce-8c6b-be5a667a6acf", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1a6516-6ad5-4808-9f6e-32d066e24468", "sighting_of_ref": "indicator--7026a937-c642-4ad2-9163-37e03f86a7aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--959f2203-0c75-476d-9689-0e2001ecea4a", "sighting_of_ref": "indicator--9dbf6b45-db8b-4f31-a541-02783d1baa9b", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25bf3cdf-1853-44ff-b460-ade282051928", "sighting_of_ref": "indicator--e99e3031-5649-4b98-9324-4fbf96690d45", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd8f6970-bd10-4614-9b1f-754b114da06a", "sighting_of_ref": "indicator--1c4d9204-d32d-4d36-bbef-e0c70a790df6", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6777e6e3-57e5-4f74-854b-45d876a79a47", "sighting_of_ref": "indicator--1926b33b-b31a-489d-97f2-ac3051baf793", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7afcd8b1-0a3d-4e25-992b-e412ac7c47c7", "sighting_of_ref": "indicator--b6f78071-625b-4c04-92d7-7cdd6cdde463", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--634205b7-64b8-4922-b1a1-085290d9f004", "sighting_of_ref": "indicator--87d0ddc0-c774-4278-a737-09280df64a9c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--198da894-b3a7-4fc1-9ded-f71d93d70e5b", "sighting_of_ref": "indicator--d4fdd335-1728-49c7-a949-b1e05eecab15", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82ae54b-016a-4b86-95b4-598c9d81323c", "sighting_of_ref": "indicator--fac8c74b-bb6f-4a16-8a35-b61729af6b2a", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9b31f1d-b358-4ceb-a6f1-4e29cdcebadd", "sighting_of_ref": "indicator--dcd56d60-3643-47a1-ad7b-9f74fa15ed4e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0d94550-df91-493e-a19b-1d320e6bc456", "sighting_of_ref": "indicator--bac53ef3-64fe-4f10-a772-c94f8e95c550", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41345148-eeb0-4f19-8ee6-66753e05e740", "sighting_of_ref": "indicator--192903a9-0b07-40f7-80d8-848994418a23", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbeb874f-bb15-4740-a883-76ea7bf44d18", "sighting_of_ref": "indicator--7bf15f84-5e14-4ace-8787-2b1e96a370ac", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293878b3-eddf-41ae-8e96-7fda99962639", "sighting_of_ref": "indicator--6ca89535-fb4a-444a-aba7-f260a8d50c37", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f21b3c0-0772-48ea-90c9-0d18491ae6ef", "sighting_of_ref": "indicator--d9b5db3e-bbf6-494f-93df-be20ad694551", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a368cc1-4649-42b3-8753-b6e90bc39d93", "sighting_of_ref": "indicator--75ea1e47-36f2-4ca9-a532-39fc218d8970", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f167571-d46d-42d9-8076-40c8d0d923ae", "sighting_of_ref": "indicator--1a6dd351-0edd-4ec1-afcb-7b73201b5c60", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9b51a33-b675-4083-8008-06880eab8b79", "sighting_of_ref": "indicator--1e7727e6-2d6c-468e-a60b-facf8b0f0344", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2472079d-1d1b-4f3c-a80b-83c2b898df11", "sighting_of_ref": "indicator--4cdcc31a-fbbb-4088-91f2-c527c1b8ceea", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d828e9e5-814f-4d17-bb60-a1ef83c90f71", "sighting_of_ref": "indicator--a14a7d4e-7886-4b89-994a-8fdf34cd38da", "where_sighted_refs": ["location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc250930-8238-4208-bfa1-b699c97eac17", "sighting_of_ref": "indicator--8ef4d3f2-1323-4c1a-8180-1cf78ba4f16c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dee2b0a8-9c21-4845-b3ce-c29ae9c88f07", "sighting_of_ref": "indicator--c5a7016b-15d1-418b-829e-553ebc049d59", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e2d5b0d-d476-454a-97b9-96e80265faf3", "sighting_of_ref": "indicator--09b1ae8d-64e5-42df-8601-21c839c99876", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58208927-7583-450f-8382-fe05d900419a", "sighting_of_ref": "indicator--6cfcba79-1110-4f95-85d8-2e386e63d338", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f6dded-5c4d-47e3-b3e0-d4352062c3d5", "sighting_of_ref": "indicator--fd2e76b5-7260-43c6-abf8-7a31765a67d9", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cac1000-00a2-4769-a3a5-d48be507f030", "sighting_of_ref": "indicator--444517e9-1676-4a9d-a911-7996cd1c5fe5", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1522497-ee0e-4435-8a69-40d34c6b4922", "sighting_of_ref": "indicator--c676af05-99c9-44a5-bfcd-442659a639aa", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b7e7cac-235c-4246-b8e8-9004d0d14cdc", "sighting_of_ref": "indicator--02bb82bf-1dd9-4a98-b1d2-ef38da3ee901", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--995483ba-bedc-46c9-be17-7921df94d7f7", "sighting_of_ref": "indicator--15c63a9c-4199-49e7-ba71-a246999b6469", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a2fe33d-8f42-4481-8ef9-04a884d20635", "sighting_of_ref": "indicator--3216c20d-d6cb-4bd7-b473-185fcbf93518", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1514ee2e-4933-4131-82a8-9d7339bbacb1", "sighting_of_ref": "indicator--ad68e99d-5298-4a41-ad6e-bbdf986a9c6e", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--420e7b89-7eb3-4499-834c-9ba0f62213e7", "sighting_of_ref": "indicator--0d208365-a778-4a47-9f74-971213156a1a", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17efe23e-3e3a-4e81-aea7-c867fc66ff11", "sighting_of_ref": "indicator--c436f948-8da5-49bd-abc3-3ed9a02c40b0", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d32a877-1894-4a7f-8f3e-f47734728ebd", "sighting_of_ref": "indicator--861a142a-59e0-42bf-800a-2e59ca398f29", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49a6748e-303b-41b8-8081-ab822730c975", "sighting_of_ref": "indicator--dd110ed9-9da1-431d-bc29-5ebe75fa3840", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--611c38a4-7aa1-4302-9b8f-1f54351e9740", "sighting_of_ref": "indicator--ed85b953-6ba8-4cc1-b461-4c2c329d0354", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41902b73-710e-4338-a79e-18c8a3962109", "sighting_of_ref": "indicator--89f9cb36-07ea-4642-8757-a1a1a91fc06d", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f9ac22-105d-4a15-a601-30d3944210f9", "sighting_of_ref": "indicator--ad850d8e-6da1-4427-9681-c6e5c26e496c", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa95de52-1fe7-40b7-9ccf-b3a19f8160b6", "sighting_of_ref": "indicator--04ca892f-e53d-402d-9bf4-c4f7417f2723", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee06c011-d59f-415f-b8af-d04919bb8161", "sighting_of_ref": "indicator--8d146c15-563e-4508-a545-ec68e7abeb86", "where_sighted_refs": ["location--cd8320c1-d661-4322-bfd3-0183482991d0"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65df76d6-74ca-4716-a8e6-b61f5d727329", "sighting_of_ref": "indicator--87c7e47c-a2f8-4f38-9037-2605c91e4d01", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01e3cd0-4718-4cae-ab22-7346d53df782", "sighting_of_ref": "indicator--2bcce8ed-5bb0-4750-bd70-b75494c57862", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47201923-86c5-4184-b663-3682c2977cda", "sighting_of_ref": "indicator--b6f7fd5e-f90e-4ee4-adb9-f250c7d5bf39", "where_sighted_refs": ["location--80231c01-31b7-4e05-aff8-e70ad8362e48"], "first_seen": "2026-05-17T00:00:00.000Z", "last_seen": "2026-05-17T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--190444c5-5571-41ee-8fd1-d5b591cca176", "name": "Threat Report for 2026-05-17", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-05-18T11:00:03.234Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--848f6519-0a94-44ca-90a9-b840f1def475", "location--a9b54b9a-d46e-45a2-81bd-3b1e0c5f10c9", "location--80231c01-31b7-4e05-aff8-e70ad8362e48", "location--cd8320c1-d661-4322-bfd3-0183482991d0", "location--dc0f6a58-47f1-4531-b6e5-09f55c320471", "infrastructure--d6ae9f1d-9d05-4594-8da5-8207c093c7da", "infrastructure--f3933941-f6e2-44d1-b794-61b51dab54b7", "relationship--0e37d123-45e8-4d2e-81e0-5aba4fc86996", "infrastructure--5e2ae329-d1e7-4ef6-ba7d-60899b2e9629", "relationship--096d3b5a-ce9b-41cb-863e-f410de539172", "infrastructure--bc37f5c1-b310-4e6e-98b7-255fd38b7d44", "infrastructure--e58fa8b2-1da5-4ee1-a67c-c1257b10c450", "relationship--73a80c75-3d04-4bfb-b823-5392cf208d20", "infrastructure--b5e01484-d232-4b31-bf5e-864333a6e7d8", "relationship--a56ce9bd-b386-4a97-b350-c0d615e46e76", "infrastructure--d9cceac8-6d6e-41ff-9f59-32fed5792392", "relationship--eb6627c4-8f90-4d77-a45c-9ae9964e7943", "vulnerability--14d0df41-42dc-41e6-9ad3-08e6e237cf9a", "vulnerability--2da8283e-51cd-4f01-a124-d12a7d89b0bb", "vulnerability--9da2f1da-4258-4266-bd28-88d886934230", "vulnerability--611c1a3c-aa7b-4f86-84c3-43bc23370cfc", "vulnerability--e38995d3-0612-4c44-8994-31701747295e", "indicator--1743579d-7202-4228-90a4-37531d2fa53d", "indicator--7926240f-053d-420e-bac1-a4ffe03cb056", "indicator--1eb69c85-8292-4023-8101-5d786efe079b", "indicator--82efb8a4-439d-4f67-9d4b-7a31a003189b", "indicator--7fe5a5bc-f8a8-41d2-b691-95a7449276bf", "indicator--3eb4b42b-c7b3-433f-bd61-2b45033fde89", "indicator--8f14c190-72c2-4967-aaa1-d1d7cb2519ed", "indicator--4e4d39b7-fa78-47c0-9200-5aeaa469a5a0", "indicator--a3cd3c02-b655-47b6-ba0f-2991134ca9b7", "indicator--b56b59d8-a414-439e-a46f-395d0e9d4bee", "indicator--7698a03c-3278-4ff3-a870-39fdcec4187a", "indicator--23c361af-59d1-4b3f-8cf1-5652294d6d46", "indicator--5259288e-f8b8-4e5c-84c8-15f15a7066ed", "indicator--f075a1a7-4a8e-4b8c-85fa-c3045b6bcab6", "indicator--9de91739-3a3b-4be9-b4e5-34117bbaed5a", "indicator--4f1f51d3-2aac-499e-9315-497e5458d76b", "indicator--94e3ddff-6797-4382-b601-c4db231718cd", "indicator--9523e930-9447-4ae8-8993-d6dde88d3ddb", "indicator--5a3d2960-2340-4d6b-89f4-b8becb7671d1", "indicator--d9468d5d-4c59-47ce-a131-738fd1eaec0f", "indicator--2171f1c2-a201-462a-91fd-d8a59000fe2e", "indicator--8520e6ba-aa15-405b-8a3d-58fcdff57cee", "indicator--e4602a9e-475f-4f35-a9c7-21046e991de5", "indicator--55afbad7-ddac-4237-99b0-dfc7c622581d", "indicator--d4d2e8ca-92f4-4755-a1bd-0e03744835c7", "indicator--7cab5c4f-f266-4500-94ce-3cf6ceced6c7", "indicator--8f538436-7ed8-4a09-b365-c854a10fb668", "indicator--5e7f575b-eefd-437d-8841-af6891492e45", "indicator--292deae9-6810-485f-b9d3-40196f49e436", "indicator--ebe6d5dc-8924-40e9-87c0-655db8a5e7e4", "indicator--45805681-9b90-426b-ab7a-83b10110e933", "indicator--f9bc09d1-7966-493d-a0e1-44e062c5ea52", "indicator--5b892035-cc8a-4340-86ba-b65732344652", "indicator--7208d26c-9b85-45f6-abbe-919b5d5f805b", "indicator--2d16bb76-a7a3-427d-a7b2-f9a9e53ebb39", "indicator--43e5c5d9-175c-4e98-805e-b240d4cc1d3b", "indicator--e3726a38-ace6-4777-a62a-b53da17c6100", "indicator--6b7ed404-74c3-4901-89c2-219b785d0fe5", "indicator--0db315db-b281-40ac-8c57-e13fee506258", "indicator--ac5308cc-00f4-4ac1-a938-c5beac19a892", "indicator--b0582b57-d6de-4ef1-9f15-a6c170aa03cd", "indicator--3a3ede10-1875-4d4c-8bab-ad1487280e84", "indicator--664e8091-46e5-47e1-a7eb-fe01d3ab7f87", "indicator--262ca88b-852d-4676-9403-0775657d849e", "indicator--7e489a6b-3ec7-478c-aff6-1f5345da925f", "indicator--7689fc56-1ec4-48d5-bccc-ddc9cc09be2d", "indicator--7439b027-8549-4531-9030-ee7420e0c655", "indicator--19a36375-023d-4448-bc64-77b843617ddc", "indicator--791cc4e2-4e48-4c58-92d4-e885f1bb827b", "indicator--0e396963-a4b3-4eb0-b7c8-4453942108c1", "indicator--d9457701-ef46-4996-8e51-e45ed9d9d20a", "indicator--58f75de5-dc15-47cd-899b-4e8f00049ff8", "indicator--53d6226d-a561-431b-9925-f197ffe5667d", "indicator--57c54ff2-7dc9-447e-8f0b-f40b7564c06b", "indicator--6f49ef1f-aa9d-4dc2-99c9-a9dfa18cb0dd", "indicator--e39c985f-12b9-4978-acdb-2582f49bc83b", "indicator--e367facc-fabc-419e-a00f-bb110762925e", "indicator--c0b115e0-71fb-4c92-aa3d-26e7f84cdefd", "indicator--0d7bca63-b3ac-446f-a819-87c4bb47db7f", "indicator--fb6551d7-232e-4c38-a0d6-521e3d0c6c7a", "indicator--493d68f0-5fd2-49f4-9ab3-6c7563f7c0f8", "indicator--16744f44-2419-4ec1-a919-77fbc54c6ce5", "indicator--ad290950-77c6-4e93-a81d-a8703aab5093", "indicator--d15471da-1578-4d45-a32b-9a6b6b207d66", "indicator--2bcac25c-83bb-4f05-81a0-9c958a809c06", "indicator--67a219ce-a5cf-4872-aa83-b36692c3e2f1", "indicator--ba442aca-2263-4374-9664-42897022a3e8", "indicator--880a0f25-0b39-4775-8117-00c9603e7c32", "indicator--a1866938-5853-4e2a-b0a0-f06e33755d42", "indicator--f64733bf-19f5-4ea9-9c51-f333cf73fc71", "indicator--395af791-2be9-4ab8-8fc0-da9d73d4b23a", "indicator--7bb2eb8c-3892-41be-8dea-6e3822317507", "indicator--ce3479a4-1a26-4ee5-ad14-4f8045f65c18", "indicator--a515f22f-85bc-430c-af41-53ad1672e754", "indicator--dac77478-0dcb-45bd-9b4f-f96fd5b7598a", "indicator--7890f513-7d62-4151-95b9-a3eb77ecbe0d", "indicator--df8a2071-b5a7-44cd-bf27-c21b33c9d3e6", "indicator--5c88dad2-7ffe-478c-b35d-74993dd2dc56", "indicator--f6fcc9b8-86f4-4249-af60-c333f722c578", "indicator--5318d50f-6f78-44ae-925c-f9fbc63797c8", "indicator--29cd44c4-ad97-4f5f-918d-e54df96461f0", "indicator--09419d86-0782-437f-8dfd-7ba27a5c41c3", "indicator--d42e6c5b-aba1-4aa7-8a67-da6a96fb669b", "indicator--84eeb8d0-2edf-409a-910b-736123290a3f", "indicator--26399472-7188-4c7b-9fd1-fdf199e2429f", "indicator--31804cee-601d-46e3-ab0e-26d4af2969e8", "indicator--54394690-846a-466e-b372-6db720b3a1d2", "indicator--837b1200-c65b-4779-8360-1fe74375263c", "indicator--f0c57a5d-5f91-42b0-b2a6-5390ffa66768", "indicator--b257ef34-8af4-4160-a2eb-795adc352daa", "indicator--2960dbdb-58dc-4904-a399-a2ec5b193c9c", "indicator--6476518a-096b-47e9-bff9-dc7216783315", "indicator--05fa4dd2-b6e0-4ce3-842c-8462edb30245", "indicator--d40baa28-b4ee-4419-88ed-58d72057ed7e", "indicator--501c201a-9706-4219-bcd6-856dcef81b86", "indicator--58cbc8e4-69d1-433a-b31d-a69c04560e55", "indicator--cb381e5b-b30b-40ea-b7fe-0333837ea9ab", "indicator--9fba30aa-3451-4cb2-9edf-cfe6e84f9422", "indicator--09842818-63a3-43be-906e-7d348c5edfbf", "indicator--b220fe25-d8be-4666-a491-3e1b1a280ee4", "indicator--92d61291-9cb3-47c1-9672-4a0818425729", "indicator--795bf072-d537-453d-9cdb-b6f264182650", "indicator--51e3894f-5d71-4f0d-9bf4-06ece11baf48", "indicator--c5c9adf6-1ca4-4361-bd34-6eabc2c15b2c", "indicator--6757e8d2-49b4-4b52-ace6-d54dcd5d960b", "indicator--5f6ea428-7de2-45a5-9cc4-51cd97a9b62a", "indicator--64662553-9050-4315-ae76-acd821729106", "indicator--a03e84c4-3bed-4bd0-851e-5ad52ffebe64", "indicator--d559948f-f835-46ba-a6d9-4b4842828d9d", "indicator--537afbda-b5e1-4254-ab25-8cfb95d16974", "indicator--5321429e-b715-4de9-9464-25e8fe3f0296", "indicator--2fd5772f-7ce2-4848-948d-ec380f507d95", "indicator--a258d79b-b7eb-4be1-b48a-36f35366a196", "indicator--71468888-42b3-43b8-9615-a0b2b1cbeddb", "indicator--556c4dde-9924-4d0a-aa7b-21ec475ad8c7", "indicator--1e621c4d-a5fb-49ab-adf5-21a873e278e0", "indicator--ef20777b-6f43-4d3f-90ae-a32d33cc69fb", "indicator--b41edd7b-8cff-466f-ba6a-7716f8f5c7c1", "indicator--a8b48be6-829f-4c1f-9ecd-6743142858f8", "indicator--d4d9982b-4b61-4b8d-ac40-90721b0cec9c", "indicator--cb020210-916d-4c20-93d7-383311058f8a", "indicator--324518f7-9131-4a62-aca2-46465dd68b5c", "indicator--972fd86f-ae47-4ff1-bdf8-8064c52efbfa", "indicator--3899f93a-84ce-4bc7-a42a-cf49f0d1b26a", "indicator--72db280e-863e-47c9-8851-e4f0fe358335", "indicator--32054a66-4acb-4d24-bb99-7d0cb6100cd1", "indicator--993b1982-12c1-4ac2-bf26-812764e9b5b9", "indicator--ecc2f659-67f4-4b91-af3d-dd130ff90a5a", "indicator--c0e74a54-4517-4ec5-9395-ef97c09f1054", "indicator--37881cee-42b3-4142-a135-54b83e0a517b", "indicator--296eaf43-8eaa-4118-a553-93cdeeaf6e2c", "indicator--6cb9434b-d810-451c-824b-913a7a58fc30", "indicator--14f1742c-79e4-48da-9e1b-4d529857f320", "indicator--856759d3-898e-44d7-8786-aef5bd0d8d7c", "indicator--b0bb18ec-c4d0-4577-9cdf-cb266e4ea2c9", "indicator--6cb47de1-6bbf-46ae-b974-301a197feddf", "indicator--ba359662-0cc4-46b6-ad45-7af437fc4275", "indicator--81d3e860-6a03-4413-822c-942f207feedb", "indicator--8b3e89a3-32b4-4829-b30e-c7d5762ac6ae", "indicator--cf475b05-02d2-4dc2-9143-11c4f9bb33a8", "indicator--367f6bd9-1cf9-4c79-83b3-a2e95d245cae", "indicator--82382f09-7a87-4514-b017-0bb73f58b3f8", "indicator--7dbfb0a0-beae-4c4d-9d56-bea0badc1958", "indicator--84cfb210-3fac-44bd-9673-9aeb859bb053", "indicator--ce1e0065-00c0-4d7e-8607-d83352e98c7a", "indicator--f64018e6-d527-4f95-8a03-9e5a1aad58bf", "indicator--adea33de-f049-4035-9b7f-45527eaf4ec0", "indicator--c3eb7de4-02da-4ca3-9c2b-aac5d4bb3c9f", "indicator--d7db320c-5f14-4aeb-8dfb-011edf69faa0", "indicator--c5721d74-639b-4b76-a8f1-9ea8ec0b38a4", "indicator--a37dbade-a508-484b-9009-d0ca5245eb58", "indicator--d96bb8b7-c4f0-46ac-984a-cc017e213790", "indicator--63a375f9-ee72-4f90-8f15-b9fc61cfd248", "indicator--2bf88e10-98e7-4bcb-8b34-7ce92cea9f31", "indicator--6897eb4e-75d3-4f31-a6ba-695941674ed6", "indicator--cb4eb721-b6db-4c76-bd3e-e825acff722a", "indicator--8198aa2b-cbfa-410c-9dd8-f0d5e92a99c3", "indicator--f11d536b-9249-4471-ad15-1a660fb56e8f", "indicator--560345c1-e4e5-4971-a4f8-cf4a9ced2255", "indicator--c584b0fd-23ec-40ca-b27c-28a224d10111", "indicator--8c4107ae-0660-4a8f-ad33-03cf7ac28f7b", "indicator--b641889d-e502-4132-b066-c1a3e776dca9", "indicator--2879ff81-1083-4d4e-904e-3d05640b4816", "indicator--1590b001-6721-489a-b0ce-47c6a009fb27", "indicator--d020abe0-db00-4fba-bb2a-917d9d6c1d0b", "indicator--528ab77e-4b52-489c-8413-be6cf78159e5", "indicator--6449aeca-b502-40fd-9cf5-911539223f8b", "indicator--c72d2d14-50b6-4bd0-bd54-7da6537d31a7", "indicator--8274523b-b880-45ac-bc6f-ea83f4e54828", "indicator--3b51d2c1-7c56-4e58-a2c2-0f40ea775445", "indicator--8389a257-bb55-4952-810c-31b4f4bea3e7", "indicator--a1f9ed02-d4ea-4fdc-80b8-1f8251792c1f", "indicator--677cbab3-b951-49c2-9864-a4a54bcce36d", "indicator--139e002b-7fbc-4328-892f-52922407e2dd", "indicator--5975044e-dac6-4aae-9d08-7220b6639a9e", "indicator--42eef0e4-dd95-461f-b3f2-a1d9b8102fab", "indicator--6f47b80d-22e9-4044-9591-f168256d8202", "indicator--3aa2959a-def1-4153-8408-3e3479497840", "indicator--a5d0cade-8aeb-458b-a767-f0f011167a1e", "indicator--a0671af4-b499-4f64-aa5d-fb651e48b539", "indicator--1ce6c480-7a0a-4518-8e34-a03120db8dbd", "indicator--bd6e15b5-4415-44ef-883e-8eb881729856", "indicator--8c3348a7-919f-450f-92e2-a4fe8f6ab9ad", "indicator--c4add938-db65-4ce0-9eca-ab95367728f7", "indicator--65e043d4-bbd3-41d8-87b1-f684c6d8b858", "indicator--7fcc4621-c32c-4824-b656-c68c26cf9c71", "indicator--31526040-e5cc-43f2-aced-b5543f2f9ca0", "indicator--6f7dc53a-b96e-4481-8267-e8b6862d96c6", "indicator--75a75fd2-5dee-43e3-9294-514919599002", "indicator--893bffa9-7a46-41e1-8b20-4f57d7fa0e01", "indicator--1a7947fb-1f3c-49dc-9eea-a8a0b8c9f56c", "indicator--bcb1edb7-c882-447b-a07a-3907c576683c", "indicator--d29d385f-5ee7-4fdb-93a5-a25e1938d3a4", "indicator--caf82848-4e2e-4970-813f-e17d8663f0dc", "indicator--8c3f4705-6603-4e2f-a516-b7bdbc9d99f7", "indicator--15ca996d-ab3b-4fec-815b-6448d01f0564", "indicator--5410440f-33b3-4619-8a7c-9dc6546b3075", "indicator--50aa88c0-402d-4ea2-860f-aaf2c87b1b93", "indicator--ab165e62-1ade-4bce-80cf-88e9990ce22d", "indicator--e1c40540-a5a8-4d86-8fb9-7159bdb5ef52", "indicator--4451cfb0-187e-4d0d-987f-fbc97d58e225", "indicator--1311e782-6545-4c06-8c38-be4c1d37887b", "indicator--967adbb7-0f22-4c54-b9df-cacf77edf323", "indicator--cff5dcbf-6fbd-4e55-8dd8-98fe213e2890", "indicator--27c07a93-abbb-4cea-8f4a-1b2dff7a4069", "indicator--731fe8a7-9966-4a66-a6b5-8b48dfbe6351", "indicator--03ef54e8-4fdc-46a9-8e8a-d27787195d09", "indicator--b90e371f-5fc6-4786-8cfe-7269366b794d", "indicator--2a841c80-d8a1-4a62-a0e1-3c1bfbfa32c2", "indicator--0b18b2f7-3688-4529-974b-c001fcfa4b19", "indicator--abacc73e-9d8f-4ee8-91d4-825a44b4e486", "indicator--bd3424b6-3017-4e8d-b9f0-1f80dbcbdafd", "indicator--5b33b63e-a37c-4e8c-9729-a770303e4a23", "indicator--b4d897ed-5b0c-4adb-9094-cc21e56c0de0", "indicator--563448ad-81e3-4616-af9a-74317c8d3ba5", "indicator--8ad91148-3d2a-4823-8bb0-c096e871a41b", "indicator--6f40c0a4-d231-423f-a396-f0ba7b5e6a15", "indicator--e7165104-3d14-4e55-a1b1-df8e7de48e5f", "indicator--7ec5501f-fee2-41a3-a763-acdefb92f6db", "indicator--eb441eeb-003f-467a-9376-cc8229fb9906", "indicator--c0c8dea9-2210-4454-80b4-d02d62075958", "indicator--693114c2-0632-4267-918f-937b5d81f4a3", "indicator--a2381237-7162-4c74-89ed-a208624f2d95", "indicator--357f4e16-7014-47b0-be22-60bbcca136a2", "indicator--c28952d3-fd64-4484-99cb-1002a621ac8d", "indicator--47a2f96f-9b86-405c-8580-a6a2ddb426e3", "indicator--03c24118-7d06-4e4c-8585-0195a03b27ef", "indicator--09eecac0-ee3e-49e2-ac4c-4a199ba86c97", "indicator--0a4f134f-d373-48f2-98c2-75420fb087db", "indicator--b849ed1e-0ea7-4e9d-af21-ec21308b7ff9", "indicator--1663ae96-8591-46da-af31-c0c64f719f02", "indicator--13c047a3-d93b-4512-9b5e-c7139b9c0dda", "indicator--6bbc0897-a7fe-4a45-ba71-5021a17ef6fe", "indicator--edfdf9e2-d1fe-4d66-be8a-d1fbf1a93a08", "indicator--e9c0fa4e-84fb-42f0-bfd9-4179f1772131", "indicator--57533631-90e0-4c40-8452-f9c640f9a47c", "indicator--f1cf51f7-7686-4dbd-bdbe-b92638f7ea34", "indicator--e1c8320b-8744-4912-b27d-636dc30d123d", "indicator--df96960f-0775-46c4-8d96-fe481e616b16", "indicator--827a47c2-f3bf-491c-bc96-093ad3674dff", "indicator--44cc3c34-b787-49c8-91af-286424588b3a", "indicator--4ebfa038-7a1b-4de0-964f-1d72d2dd1451", "indicator--15996f83-f71d-4cec-88bf-cf91a56237c6", "indicator--6131eabf-831d-4bc6-a5c5-bb9438d473e1", "indicator--12b2e1f7-fcc1-4cf7-aba0-1b3310d27907", "indicator--072fefc3-163a-440f-af70-00c89c510432", "indicator--32c70d44-0ca3-44df-8056-61b51d6f3196", "indicator--d15eab95-3f0d-4cc4-a24f-dcbf80371f3f", "indicator--c91fbf8e-b9bd-4f08-abc3-0029fe06a06c", "indicator--46088cb0-f6cb-41ce-bd50-68cef48cbf5f", "indicator--61593970-0431-4a53-b30c-f32ac0d4f5b3", "indicator--e1d19496-4b20-4dd6-b41b-a806aa17bed5", "indicator--be3724cf-fbd9-4b1f-b992-c2efb9c27ada", "indicator--7bc3e81c-ab03-4f90-aa7f-7ee936d225a2", "indicator--94403e98-4f2a-4f2a-ad24-dc2b807e6b43", "indicator--44c23e86-71ed-4948-989d-fbbac9175b4e", "indicator--10de1508-6c61-4095-836f-330df3e1a14d", "indicator--71f135b8-ee01-4d6c-9031-419c2c8abf5b", "indicator--2b0df221-21cd-45d7-9376-cd3e8f8dc752", "indicator--9a73c029-a3d6-4dd3-9071-4d92c348ad37", "indicator--eb200950-dacc-432c-9282-be7d1ca94cfc", "indicator--74b3d1df-e73a-422d-a955-5074f33d9607", "indicator--a7b22566-d5bd-44b8-886f-3635cafc76ec", "indicator--652946c1-bd59-43a1-89b2-db3da7979cc8", "indicator--f19b98f0-40a8-49bd-adf2-5cd349267942", "indicator--e57848d2-448b-4973-ad1b-3148794aac35", "indicator--67752486-5460-4e07-8c5b-b73cb349634d", "indicator--518125e2-280b-482a-b2e8-1fc595541680", "indicator--d4f61f86-342b-479a-8111-f262caa791c1", "indicator--f2af3076-29db-4cfa-bc60-f1d4f9ba4d39", "indicator--32f3ccf9-99cb-4534-ae70-ddec4d6b1baf", "indicator--d5006b15-7f36-44a0-8def-2bb768060d70", "indicator--23c0afa2-409e-498f-bd60-09b248ce0ddc", "indicator--d81fdce4-0243-47b2-9907-cf3606bb7b92", "indicator--112112f2-cb8c-420a-8a59-71749707ea1e", "indicator--915752fc-9633-40e2-b129-c35a787d75c1", "indicator--f97430eb-54c8-4dca-87ab-be93c69415dd", "indicator--e2a9f625-7e17-4a71-a052-0ed2c9c55733", "indicator--0782124a-2fc9-4258-9950-3f020b6ba95c", "indicator--0a3eb046-7dc9-45c9-bcde-d84aef697394", "indicator--a41a4aaf-0bc9-4e6f-a66c-8ad857ab461d", "indicator--334972c6-d87c-4aeb-b725-465a2455f071", "indicator--f65fe823-adc7-44f8-aa8b-2c97abb4542f", "indicator--039bdb0b-0a47-497d-aec5-542a5c3a6561", "indicator--f8e5d5fc-ff06-40cc-b32f-427b7aba9a71", "indicator--02e646c6-2d3c-4931-bb92-2f7acad4c26d", "indicator--92eec7b9-53cb-4a9a-acb3-4ff671f8a3f0", "indicator--85e2eb24-592a-4a32-999c-96864d7f047b", "indicator--c5199945-f8a4-48cc-8fa6-8f9863bdce4a", "indicator--ab23aa2c-5b4e-45da-ae0f-92c878f47438", "indicator--892eb961-c369-40a5-8a62-76fa586198bb", "indicator--9217e9ef-9862-402d-8bf6-24693da849a3", "indicator--3a2e9f41-036a-4a80-9249-02407c17b09d", "indicator--254785ed-b1ce-460f-b5b0-6835ffab0785", "indicator--eee53ae1-4d3b-42b5-95da-544e459346d7", "indicator--e670a68c-3feb-4c1d-90f3-550cc11b0c83", "indicator--7fed43b0-dd7d-496f-a564-47497108cbe5", "indicator--37d8609f-f841-40a5-aaf4-fbce5eb7af02", "indicator--961cb825-6659-49be-93df-4aebcabf7f77", "indicator--90bec8d6-ca81-4333-93ad-5a7ad8486114", "indicator--d18c60da-2204-443e-8eb3-f1bbf5057593", "indicator--ce8a2891-0166-46c6-84b4-303794f4c3b6", "indicator--5dab3244-43d3-48d1-a421-08f00f652bda", "indicator--1f1ace75-1a19-47ea-89d7-c92ff7ec239a", "indicator--f7fe2749-85a8-4220-a829-a392b6e69d7f", "indicator--0e6e1ad0-8d2e-407b-87b2-5cf22391de74", "indicator--426a854d-c1ec-4df9-ab69-ae7c7be2d582", "indicator--9c694d8b-71fe-4c67-be8b-1421ae1e595f", "indicator--dc1539a9-0e0b-4f57-96ab-819cbf6246f4", "indicator--e9caf8a1-60c4-433e-b05c-ece47f43f7be", "indicator--e7e73636-84c5-47a1-9e6c-9dcfa51cefa0", "indicator--c672ea4a-993f-4e9a-93a2-bf66960ce4f2", "indicator--a7f88441-041d-4559-bfb5-cc03f47d24fe", "indicator--51c1eb75-3482-4f4b-b85a-97a38420e66c", "indicator--7b2fb924-1853-4ac4-8c10-6a07055a180b", "indicator--69408edb-e7cc-4f2c-bf30-234e43a2ed35", "indicator--d257ab96-9565-476f-b663-07f283195147", "indicator--6ddc3888-ff22-4cb1-ae37-dc39b31f468d", "indicator--fe891873-c23f-434e-b520-34cbb64d4608", "indicator--50c25497-d90e-42d5-b2e1-e3692d2dea69", "indicator--dee255cd-1799-4b7a-a5ea-a042326864af", "indicator--096be97e-3872-49d3-947a-be8287608307", "indicator--498c58f6-34ab-47dc-bcd5-4e65dba72b0b", "indicator--941b3291-651d-48e0-9539-4362c0de239f", "indicator--c5d40fa3-a53a-42e3-ae50-f41859ac16fd", "indicator--2ee0d61d-3b24-4138-a53d-ca86b8894a8b", "indicator--ca294ee0-cc53-4b5c-bf21-e85a73275524", "indicator--1f6f2994-1308-402b-b77a-8512aaea8718", "indicator--ae3717f2-6587-4953-b788-07175505b0a5", "indicator--0d044eca-0e7f-4b3a-8578-c1b12bf7e552", "indicator--77e133b6-5d6c-4549-aed8-16df0f84096e", "indicator--500f2e0a-184d-4b46-9461-5f00fd16df32", "indicator--8d20e74e-14ae-4cd5-a52f-59d12aa405c1", "indicator--08f5ddfd-8d3c-4c2a-9b72-26bf05fed3aa", "indicator--9d790469-664c-4d12-b6e5-d0206537faf3", "indicator--6461f75f-0943-4de8-8b2a-eacc9ac0046a", "indicator--ac717500-9796-412c-8766-39811d8ce11a", "indicator--e267e7bf-092f-475d-9ef9-9a4cf601e657", "indicator--3274ef21-5360-4dae-abe7-72eb55cad070", "indicator--a814a486-5b8a-4474-903b-c838ec5647bc", "indicator--e771b7da-46d3-44cb-aac2-6c206b8eb809", "indicator--ea79cd63-7e89-458e-8310-8ec543f7f988", "indicator--4d5b36d8-d1c4-42ba-8ef6-8b432c2ef515", "indicator--d231158a-34c7-4002-8223-e4d7c76c13f9", "indicator--8571af8c-48db-4df7-9d37-7e25c1a379a9", "indicator--76441f07-5770-42c7-9858-33482a2e4e47", "indicator--51c7d0dc-c814-411e-abbe-38c7922bb657", "indicator--8faca54f-2436-48e6-bc9b-2fc45095def8", "indicator--c20b303c-ca63-4f61-afce-7a4b1da97c0c", "indicator--0f03181a-8bee-478c-9a54-bd7d65bd4f1f", "indicator--25b4b6f7-8075-4be8-8de3-3254dd72e67c", "indicator--3ee9ebad-f1d2-46df-b966-bc284ef6e7f6", "indicator--49e7ea78-ffef-4d31-ac37-65f7e04edb73", "indicator--ecea1247-e027-4855-b27b-d46a09aa901f", "indicator--495205b2-436b-496a-9c20-7b1360ea6333", "indicator--7ad17dbd-9e9e-460c-bd40-3235c01d6e61", "indicator--788df880-18ed-4722-b536-a6aaf36938c5", "indicator--e8e788c6-53c7-4b67-893e-1a211c6b86c8", "indicator--03187eda-fdb1-4f07-ab67-03dbfb2eec20", "indicator--8d14f962-e2c9-48b1-8559-0d3b6abadb69", "indicator--6d5f7563-5fe6-4da2-9ff2-82fa4990f641", "indicator--773dfc08-2f69-4cca-9d09-39b3892175af", "indicator--85fcd237-0ff1-460a-a694-da435fa770cf", "indicator--2be9d02f-9f12-4a8b-92ad-661900a526a1", "indicator--79e160f2-d425-47e5-a5d6-ada370224e12", "indicator--22d988b2-320a-40bc-889f-62ee9dc02a8a", "indicator--56045ab6-4e08-496b-9a66-a2a3b927b238", "indicator--f28769e0-5b3f-45dc-950a-c52e0b0d6fb2", "indicator--44f0cbc8-e818-45e0-a55c-02faad8298f6", "indicator--ed881b22-7762-42e9-aca0-2cd5afd0221b", "indicator--bfbd5895-cb85-4fa3-ad35-bd08263e0dee", "indicator--140ee905-a376-4919-9b1d-e6834269d7df", "indicator--b169df60-06f1-4ef9-8c0b-0909cda9120d", "indicator--d9055f15-5f77-41ca-b08a-f9965f35061c", "indicator--1ec0427f-99ce-41d2-a1e0-61bd97385b48", "indicator--5292fa89-bfa6-4104-916c-096f8f095c02", "indicator--8a6ff649-b624-4745-a436-a14f25156597", "indicator--c9df0830-ff05-4d92-b1ed-8e8ede632c9e", "indicator--94f60d48-13fc-47c8-b32b-a120e48c3dda", "indicator--20fd52d3-7de3-43ba-96f6-ad916585a017", "indicator--98a3e80a-7bc1-400b-8382-9bc884961fc6", "indicator--98c7dd05-0105-462e-8282-4f5a73dc576c", "indicator--f3c5a430-7adf-4061-ae6b-0f4a9d88647c", "indicator--bce3ce99-baa3-4d40-bd23-b5dd1684586d", "indicator--460b8a63-5fda-4c1c-9226-dac6be5dda7d", "indicator--e19ae18d-0da2-47e0-9f9c-6a32483328bc", "indicator--de9a2493-dc76-4cc4-a63b-1183a5fc2250", "indicator--a79207d1-fc02-4506-83d3-eaa944a65ee3", "indicator--23a0831e-8a7e-4bab-8df1-f024a3494f61", "indicator--2a6f2c5d-66cb-435e-a1a2-cb75d19b17fe", "indicator--1e496ba0-30e5-4e1b-a347-de3b9df775d5", "indicator--ff48bfec-f15d-4f6c-9756-f57cd6c14e5e", "indicator--584ed8fa-e5cc-49c2-b401-053b71ec2851", "indicator--95f0c681-09f9-42ff-a228-2e8ad6737267", "indicator--066b7dc2-dc4e-4c90-8572-90ba9bd09e6a", "indicator--852bcc6c-d7ef-4996-b1aa-f70dbee5cf56", "indicator--e9391331-7aaa-4d39-822c-9457ed5c175c", "indicator--aa1bd28c-6425-40f5-96e3-7581f696c447", "indicator--56a91ef9-94ed-46a3-8607-ca18795bd098", "indicator--d85c879f-0791-4d4e-a4ee-6900df17c754", "indicator--dfe80f85-715c-4e8d-83c4-f5c767b0192f", "indicator--3ae3e97c-a6cf-460f-b4e5-67d72a2a806e", "indicator--9cd17589-41c7-42f8-9b80-1ecb06464cb5", "indicator--0bc38997-be1a-44fc-9354-a263da909379", "indicator--ce2bf9e5-9fc9-4ca3-bd9b-8e75bfc93d46", "indicator--4da24ec0-6c0e-477b-b22f-4ba140b30fb5", "indicator--efe47620-c17d-4382-9c17-27116c138d55", "indicator--788300ff-ad18-4a3a-b9b5-8354c24c406b", "indicator--f808eb7c-50e1-4580-8ed1-70306054c449", "indicator--134a2147-c058-44ae-903c-a9ca4f962829", "indicator--0f49dc54-dc38-44ca-8ad7-186b38b150ed", "indicator--49d5569c-6862-4c1c-966e-c8b23178bcd5", "indicator--5cae5b92-0e88-4553-8cf6-75caa60eda33", "indicator--a306627b-1837-4cf2-8610-41a9ad3c225a", "indicator--1532f88f-20df-45d4-aeb7-2c91ab25236b", "indicator--9a99a28d-87d0-4fcf-84f4-b8d6fe3724b9", "indicator--940c8a2f-0a58-46b2-a7c6-859330913103", "indicator--997adc74-9725-4bb0-9625-f1421e176d45", "indicator--2a352167-22ba-4328-92ca-b9846d46a444", "indicator--eb4eb7fa-2212-4f73-8b02-4f3dca891cb3", "indicator--6f7d3ce7-05fa-4bb6-a007-8c3634703601", "indicator--30b0949d-9218-44cd-bddc-eede27fbb89c", "indicator--3e67b56f-2de2-409d-a70b-bb4dd1ca78b4", "indicator--9efaf122-d706-4fd5-a31e-8ca066c01157", "indicator--ac748164-92e6-41da-86a2-357e0e45492a", "indicator--1f3acbfa-5e0a-42b4-a091-9cb3de6b7905", "indicator--52e76d67-ff8c-4219-ac75-e9c209264db7", "indicator--46652e93-5fc2-4539-a36a-91f0fe9b287c", "indicator--2c59180f-c58a-41f1-bd67-6462478e24c7", "indicator--f0f52451-3c9c-45f3-a4a0-20b5d5448811", "indicator--180aad2b-eec1-4521-8507-65684b9b521e", "indicator--c4ee9fd3-ca95-42a7-8f60-da366f34ce56", "indicator--68099f92-3948-4fd2-a802-446ce51d528f", "indicator--fe45e8dc-b998-4364-a0f6-a49ffd4ac487", "indicator--bd437207-36ad-4c06-9e6a-49f73a47875a", "indicator--773d5242-3785-41ef-9530-ede5290e1956", "indicator--cae2418d-1bdc-4585-b4fe-70d9a40c1e41", "indicator--e9e6aece-5059-4ab0-8f43-d1667a2307b8", "indicator--adeb3fbe-25bf-41d9-82ac-dbc83fe910dc", "indicator--e1475c1c-5e1a-4564-87d9-d883769bf134", "indicator--dd6c5905-2585-4b42-9e21-50681d51f14d", "indicator--ac52cd5b-0058-4034-9378-fb2e3b983d9a", "indicator--fa538a4a-8591-4ffe-9963-741e49593030", "indicator--f55fb1af-b688-4c44-a52d-d0accadbef86", "indicator--b0c2c758-197a-4892-b543-6f2ba0f14ac2", "indicator--748efbd6-8bf9-48a8-b4f6-99b2c58be933", "indicator--14eb4c4e-994b-480f-9891-43df67bff87c", "indicator--fb8a1772-5a12-4cc4-8c62-4815f7f9a8c1", "indicator--a5ab7a44-8bf7-4173-8d63-a1d1d7f62085", "indicator--7986828a-6d50-489d-9afc-2ba99c768a1a", "indicator--a1e99faa-6690-4c0b-8daa-fb09765cae54", "indicator--e99e5543-71d8-40a4-a899-d6dfaf6a2958", "indicator--ba78fad7-93b3-4949-8a99-7727a9d6f898", "indicator--edc8fe72-323e-445f-b879-09cc930f6a98", "indicator--eb4b855f-f9cb-4132-8fa5-5fc45e0ea21c", "indicator--f5c8ff7b-4064-4c8d-b986-5f948f2fb83f", "indicator--0d442b47-21d9-45d1-8f90-80f866e50a4d", "indicator--97660732-00e0-4191-ac44-38fea731843f", "indicator--46ff31cd-fb15-4bf9-be13-e8bdc1ca1b80", "indicator--cc58c069-c209-4e9c-be30-9ad6d6908682", "indicator--6000f8a5-be55-451e-a05e-74e24b076b32", "indicator--6d0cde15-7ea6-4862-b0cc-faaac2142020", "indicator--2eb8905a-1975-4488-9e4f-284ccc038e5f", "indicator--e07ffde1-208e-4c9b-ba42-9ac4827c8859", "indicator--6fb1ad01-708c-45f7-945d-7d827fc25c10", "indicator--db4a2f3a-501b-4b3c-a4a6-29fc0d9ad756", "indicator--495c0965-5222-4690-a019-da148a4d9dc4", "indicator--561bc1d3-2387-4be6-964d-e59839fc06b4", "indicator--e97bb8d8-7a96-4356-918f-46fd10327d61", "indicator--53547ded-87d2-4fdf-9802-db8ea3a39382", "indicator--e04667ff-862c-4776-9954-9871fbed3d11", "indicator--c1912cc0-2949-4130-a033-9f187469de58", "indicator--73147c44-0726-48e2-9289-dcc091e993f3", "indicator--a0880ca0-5a2d-4e49-acad-762ca50c2d0a", "indicator--de7d524d-091e-452c-9379-6ad2bce97e65", "indicator--8604a814-a3b4-47b4-bfdc-c082012035d8", "indicator--92be606b-ddb3-406c-8326-db5acb4474a3", "indicator--b73ed89b-9524-4bfe-8990-aab6581860bd", "indicator--c4773eac-c362-48f5-b26d-63865a25b7b2", "indicator--6dcabef2-e58f-4d77-8b0d-a393ceab39ae", "indicator--6e54cdae-5730-486c-8473-5866d253e780", "indicator--7332e792-d720-43f9-a96f-6667e7ede4c9", "indicator--24da6851-81bb-444f-b32e-1577c8ecee0c", "indicator--7fb14aad-6af3-4efb-86f9-359be41072ae", "indicator--47fa39c6-1a44-48f7-b331-7151a07d43e9", "indicator--19f57326-dea7-4343-b85f-e7e00e97722d", "indicator--f2adc9a8-ba00-485a-8479-6de6acbde891", "indicator--57fba122-562a-4504-8cc4-c09d1ebc1a27", "indicator--b6e6b6b4-6906-4f4f-8b23-c4b2c564d1e8", "indicator--0bce147b-6c2f-469a-b12b-1a1804b75958", "indicator--212b3076-3c36-4af5-8f32-ca7ff21fa013", "indicator--9ca97e08-56dd-4840-ab7d-cfb3b8c39e81", "indicator--95c161e3-6265-494b-9c3b-02f891ac5a30", "indicator--ec0c8c05-ae6c-4184-9935-aa2c364bc69f", "indicator--327b968c-8d17-4e3a-893c-a1350fb89e92", "indicator--338f38be-700f-45f0-a788-689f0d1b484b", "indicator--6a880b68-afca-4102-a300-837b0ab00b61", "indicator--5dccfd49-b784-42ab-960f-4d03bd361ad6", "indicator--a5060a72-0cec-4349-8192-9e901aba164d", "indicator--a0c5afed-570c-48eb-a5dc-3bd20c722bce", "indicator--458c3e82-1f09-43b5-a53b-5542e22105b1", "indicator--15dbcecb-af36-4938-91d3-d27406759654", "indicator--a41aa8b1-4c7d-4d31-af04-479c4d3d1fc6", "indicator--a5509d28-6134-47ab-b8cc-a036e033eb84", "indicator--394cba6e-50e0-4527-96e8-9ff07f143efd", "indicator--1637dab2-bf12-472e-ade9-23bdb53db416", "indicator--e10987fc-bf1d-4170-8dc1-579c9a9abdf1", "indicator--31a2376d-534a-4beb-b9b0-77f636abf80a", "indicator--dcd1f47e-1226-478a-87bd-3e093ce10f46", "indicator--6647a312-24c0-4a74-bfea-655c48c30299", "indicator--46685a3c-d72b-496e-a064-7ef98aaff78b", "indicator--556856ed-e36d-4c73-9fcd-00e3cf8b547a", "indicator--ff4c80cc-5541-409f-95d8-b629dee9904d", "indicator--d5a7735a-3953-4890-9ff2-e610c2c0adf5", "indicator--674dbcb5-a5eb-4aa4-9853-a30fcd42304e", "indicator--a7185701-667f-4191-8b92-04b129954761", "indicator--c76fc0da-0a57-4cde-ace2-a159625abeac", "indicator--f151123d-c238-4ce1-88cb-e21b6d9070b1", "indicator--d57eca28-3945-41fc-99a9-f744bc1b02f7", "indicator--d0dca87d-54fe-428c-9633-a8dad86f4663", "indicator--d1d999c9-a437-42ca-a55d-493ed12222a3", "indicator--57c515a6-a3c1-4d53-9e41-040dbefc99fd", "indicator--aee6cdf8-396c-4728-afe7-f89af5a1c59a", "indicator--eb3f8fa8-52b0-4aea-9d82-3815280b4787", "indicator--173c7521-7679-4bfc-a9b7-0f3e17afcfbf", "indicator--7b0fd0a3-4960-42c1-8f8c-93cb1bab37f5", "indicator--1e6e6b40-7458-41f7-a71b-da16b5837e75", "indicator--de825265-3bcc-45e5-9abf-c5e4fa5952d4", "indicator--0c53adc3-68a4-41d8-8f83-e5a5f5cdcb23", "indicator--7955d7c0-a992-489f-9c22-24f164058bc9", "indicator--de33d330-b39e-4d74-8654-3025acc5d3fb", "indicator--e9b3691c-b1aa-44fd-ab24-3c9b5452bc62", "indicator--e6e57cc0-b947-465c-a159-aac89fe73e5f", "indicator--c3ef804a-472c-40ad-bcc5-376564c816a0", "indicator--ab01c26b-5c44-4ad4-ad17-72beb38d9414", "indicator--4811fff3-37c2-45e4-9153-a8790b651ebb", "indicator--5183015e-cda9-4983-8aca-6128d26003f6", "indicator--943fa0cf-738f-4308-be85-863e8a604928", "indicator--fbb108bf-ef57-4b97-91b7-77b5fb05cb2e", "indicator--71cc4fd7-b027-45a3-8d10-4d3944d3f400", "indicator--14c77e35-a529-48a0-8834-96b67fe801be", "indicator--6b301a39-e15e-4245-91ad-048f4d86fa09", "indicator--524b5778-b3d4-4953-91ab-cb1a65285595", "indicator--e7dd1bf1-2e37-4eeb-8c4c-fe7a1a98af5a", "indicator--bacbc8e4-4ddf-4b11-a743-da31c0c48114", "indicator--d3f32a54-40ad-4fab-9600-6772bb3361d7", "indicator--7733efbc-d8a7-425e-bce0-bcd5449da64d", "indicator--48b3454c-0689-4a40-b0dc-2a47478bcbc1", "indicator--cb343cb9-8987-443e-be04-18b9423d047d", "indicator--a23ca60e-b853-4a57-ac65-7bf93e82e836", "indicator--3aed9e98-59e7-40c8-aed2-ee60040dcd50", "indicator--216f9efd-cc64-4c39-a56e-b00a5a6cf655", "indicator--39b0b667-5049-423c-bfaf-0f32a1dad5cf", "indicator--f060933a-e8fd-4492-83c9-6376d1d55699", "indicator--edc017ce-98b7-4842-8779-c0fe443ee181", "indicator--cfbbc460-9afd-44ba-961e-3a36fc7d736a", "indicator--d3fe5feb-8fc2-4e3a-9627-3982554cfd7a", "indicator--5efdc668-2e75-41e1-b112-fb1188e6591c", "indicator--39b3ba32-a27d-422e-9ca3-c186d7200cde", "indicator--637fe239-14a3-4e7d-837f-422a867a5dde", "indicator--c7da3831-a877-4951-838b-01c1fec3f3e5", "indicator--ac56b2a6-d77b-45e2-a409-dae95987373b", "indicator--772ea6e6-7b96-468e-8488-5b159dd37748", "indicator--b1e6e12a-cc7f-4562-85b2-16dd889144fc", "indicator--76c374f3-35e5-421c-bb53-9fb5f12cd756", "indicator--ca9c99f0-4db6-4427-bd4e-22fc115e0264", "indicator--53199e38-666b-4a97-8436-752f1eb6f0c6", "indicator--5664271f-4ea9-4070-b9c1-cabc0edfae53", "indicator--29ba099b-bcce-4a98-a2fe-b28f20d31062", "indicator--7633eece-7b95-46ac-9d77-7207ad4e4c62", "indicator--f1498a7f-0c7c-4b9d-878e-58fe13dff8ff", "indicator--e45d4646-e241-4387-a535-214c88bf48d1", "indicator--918ee58d-4fe3-45d8-aa4b-1fe6a6ddbee6", "indicator--501b4d78-2478-4755-946a-bd3f902d1ecc", "indicator--eafecb84-c889-4a18-b3d5-68fb0fa7531d", "indicator--6cd25279-8ec0-46a9-ab33-b1e79f8e9776", "indicator--32fc95fd-f43d-4486-8e56-d9cf2aa6aa94", "indicator--10f74112-22ea-4bde-8cd5-7c8b9af996a0", "indicator--f488a517-f923-42e0-a75d-59445fb8748e", "indicator--c00b0dfb-f110-4eb4-9f61-50e0db7dcbc0", "indicator--de42912b-42b2-4efe-91e7-090ff5bb0324", "indicator--3dcff657-c01f-4831-a2b7-f1e488f3e924", "indicator--0c1d7ef0-ffa6-4642-9726-ce53dbcbd697", "indicator--9627d49b-b7d7-4831-a8d0-c19b22797dcd", "indicator--1d365253-de40-4818-b8a0-a0f19e867f4c", "indicator--92ae73d6-38b2-4f0f-8b43-10bf84110bcb", "indicator--35519b57-f15f-479b-a830-6343a7ac72cc", "indicator--db8f0738-dd66-47bb-9a05-f79cd187c455", "indicator--40a61a43-f349-48ae-8695-90511ebbdc5f", "indicator--0f0eae4e-f0c0-42bd-b46a-9187a56060f8", "indicator--dd9961e5-b8d3-40f5-8fc0-c1771a527293", "indicator--843cde55-a40e-432c-a695-8c171940e1dc", "indicator--bff79293-e0ae-4f99-aa80-8692485e6480", "indicator--bda593f5-3148-4436-98f4-8e051239d9d6", "indicator--4e7cb482-91ae-45c0-b5a7-7f951e32286b", "indicator--029d5a14-6723-4478-a0c2-e59139924bba", "indicator--e4b94798-5be6-4cda-a233-035ec5ac44f5", "indicator--b603ca8e-6c7a-4b83-bc30-402b7e70c08f", "relationship--9aa6e1cb-bc4b-4bea-8723-f32987cbee57", "indicator--c1631742-b9fb-46e7-9966-3e002c0500bf", "indicator--0bf3beb8-8272-47bb-b9a2-b3fb89f4a29d", "indicator--1cbfc5ab-e531-45ce-8d2f-44b075217b76", "indicator--ea654cfc-ea70-4fe3-9c86-23fa73d9a6ae", "indicator--4d0245d7-20f9-407d-9e64-243b85775746", "indicator--85d49b3a-413f-4d22-bbf6-9f1ddfaaf6ab", "indicator--93c63fbe-665e-4d2f-bc91-f3928edf4252", "indicator--33e25831-2063-4990-aa74-45024c94fa4a", "indicator--06de6ef3-7de6-4240-b808-70c3557c2108", "indicator--6bf15b76-21a4-4c66-9f87-c0cc57083c91", "indicator--03be7c3d-b5d9-45b9-a65f-df7bbe4dcf6c", "indicator--83c9816d-3e6b-4e8c-b8bb-78c3b7c204a9", "indicator--127c72b4-039f-4e14-b475-6ce225b9f53a", "indicator--dc98f6f8-60ee-4a86-9573-fd8930d7c40e", "indicator--ad2385d3-8815-4fcf-b390-f999b17d7a35", "indicator--697e8157-87d1-465c-9bb0-18a09cfb6357", "indicator--60b85bc2-71ef-464f-a7f7-e32a7b28d685", "indicator--85d765a3-89ec-4ace-bc6b-1b25126c6060", "indicator--ea7c82f3-0125-47c3-a229-ebd6593cef4d", "indicator--6e64e413-021c-4173-988f-83afe97c8d3f", "indicator--bd1ed626-56c5-4f4d-b919-ba3719b810de", "indicator--8c06b327-d672-4422-98b1-6678e381c7e5", "indicator--2ab019ff-2ecb-4e6e-8ed6-5ec6479c443c", "indicator--20b52a30-d778-4534-a387-f12b4d66dd60", "indicator--6cd93b30-4fd1-45e0-b866-1c912a1ae210", "indicator--ed14d5d0-0397-43f1-8142-1d57cf4e467a", "indicator--51b3bb05-c0f8-41b1-be5a-e43dc7958836", "indicator--362485aa-211c-4060-bec9-a20b89976e7f", "indicator--446a0c1e-f2e6-4208-9f4f-3b9865527770", "indicator--7dd0c7fa-31a9-4b29-ba6f-51618d72302f", "indicator--b7ad8621-a157-492e-b789-e5045e7014ec", "indicator--33f0e3fd-2d8c-4d64-9658-7b35861212bd", "indicator--6b68f853-f527-4985-84ee-a69dd27c8108", "indicator--379b14be-f6f7-45fb-81d5-9ef214dbb573", "indicator--5acec222-c0b7-4f32-9430-2c1a7adfcec3", "indicator--2103ec17-aca6-489a-9ac0-51c44bd4f136", "indicator--d4f56768-7515-4092-b26a-24c8860116bf", "indicator--80a91d81-f3c7-4cfa-adc8-920796cd30f5", "indicator--a59e9dbe-7a93-4c22-9a47-6983bfdbd579", "indicator--04db5bbe-3919-4177-b96e-53cd7ded1b94", "indicator--3f82a80a-24aa-4edf-908f-804af89fa8d1", "indicator--209021df-df6c-446a-9f4d-44273cb3bc34", "indicator--b1de97ef-0b9c-4796-a32e-78dc2f5d0ea0", "indicator--92c8302e-6950-408d-a648-c8986c1dc21e", "indicator--d7c8d8e9-1119-4393-b7a2-a1c533c4383a", "indicator--4b921d01-cbb7-4c97-b46b-d8b8566b7c4b", "indicator--06e91349-79dd-4fe8-abde-e6bd6800ca5c", "indicator--394ad1a2-bccf-47db-8c49-c928a9d26ccc", "indicator--9c7ae9a8-96e0-47b1-a99e-6655dafecdce", "indicator--b7a4096a-f3c3-46e5-8160-bf341aaf2df8", "indicator--0a88dc77-3d57-4a32-a466-053a0c6c82ab", "indicator--2ace8756-4255-475a-a819-5db9fa961102", "indicator--07da6a2d-d676-435f-a649-bd51f63f6918", "indicator--d8a7f6e4-52a0-4f31-9f5d-d74e057186b6", "indicator--e112fa82-b634-431d-86fb-eebaa134a43f", "indicator--cf810779-7cb5-4b76-8a1b-ef271240f386", "indicator--f268f239-94c2-4329-b984-63748911a958", "indicator--ba43b19e-6ec1-4660-836e-7c49737f81f9", "indicator--81208802-ed18-4bb5-b27a-e70cfdb7bdc5", "indicator--fae839f2-0f8a-449b-b0e4-f70c9b64c64a", "indicator--72771632-cc68-4379-b70d-fff1b8440d56", "indicator--973be874-0456-473f-8499-022c0ad4138b", "indicator--065c84fb-f7b1-43ff-b9e5-4a74171e49f0", "indicator--a7f9f2c6-9222-44aa-b6b0-833c6caa730a", "indicator--ca07826c-f980-4152-89a8-626b26ca1d1c", "indicator--71ac39a3-ede5-470e-9f6a-cd9ff636b754", "indicator--ad9d4d07-1d67-47cd-9678-f349e2269d22", "indicator--a72784ea-5229-4c85-8ba1-cde359f1286c", "indicator--1793e93d-234d-41a4-8fd3-3240351d669a", "indicator--1163613d-2bdc-455e-a069-3e3fa224df98", "indicator--a584369d-c3de-4aee-a8f5-ce020c627458", "indicator--004807ff-5727-4ceb-a831-402dfd8fb308", "indicator--17a73141-bba6-45fd-bfe9-53d5366077e9", "indicator--77a537ff-a8fd-4d1b-bff7-bd51ff04e94f", "indicator--68ff1569-6811-487e-adf9-c45b107e1be4", "indicator--3fa587db-82a2-4e79-bdef-f102edcb0139", "indicator--dd69d03c-7221-4dd3-bcec-47dfff0bec49", "indicator--4352d5ff-13fd-42c2-932a-d625cb135b17", "indicator--c4f0fddf-9eba-4a96-94fc-88bed7c99b5f", "indicator--8470e178-8049-4fa6-8fb5-fcabbb49b5c2", "indicator--97098bac-f852-45b3-a9e0-9a1a0643fdb1", "indicator--09f03aee-03da-4284-843c-5659130dd2ef", "indicator--784e3f74-c241-461c-82e6-b58d88fbdc78", "indicator--182d32d6-a054-40e8-a528-0a66a896fa39", "indicator--9ecab157-8eca-42ed-adc4-35b388eabbef", "indicator--b077f1c3-10fa-46fc-90a3-a8afd2f93c4e", "indicator--94c54c79-a34f-4d3f-b704-e13966dfea88", "indicator--af55485f-0c04-411a-980f-dbdd0217d125", "indicator--7824ff8b-a17a-4be6-84c3-2229c9ccc730", "indicator--ee82847b-73a2-4895-b99f-f509fa32eca1", "indicator--56691b96-0f99-4002-8657-61f70b7aaf61", "indicator--da657285-f47a-4589-b96f-0d38224601b7", "indicator--42546a9f-413b-4495-aad5-14f8e039be43", "indicator--e9849bf1-07ac-4309-b55b-d53014afc9c9", "indicator--7b9f3240-2a63-4b5d-a79b-26ef19f1601d", "indicator--a3f32b0c-e144-4ffe-aeb5-1ff5aef0a518", "indicator--457fc0c4-95a3-43c3-ad9f-071db9e54d2e", "indicator--d6a06e3d-b726-442e-a54b-9149a254bc54", "indicator--5691e136-d0e4-47a6-80f6-3f2876d1f588", "indicator--c74df22c-4198-40cf-8fae-c5eddd8c7a2a", "indicator--a94c89aa-5502-4c79-85e2-16f9c32dfcba", "indicator--d4a67c48-4a85-4b42-8e44-d01586f40dd2", "indicator--9848fbaa-dd72-4052-8d53-bff068d26129", "indicator--c91b3b43-c683-4df6-ae78-fd4b986468cb", "indicator--b883ef4d-54f8-406d-a62d-32549acfaf98", "indicator--130b49d0-b708-4c40-9eb1-66a96ebbd444", "indicator--6a39c0be-7daf-4839-9cf8-b13134770028", "indicator--fd5ab9a6-5ace-49ec-b636-bdc823e49764", "indicator--dc7a5188-2943-4bbe-8b60-cc32d481f37f", "indicator--2315f181-bbd6-490b-a2af-ae17dde21470", "indicator--25d44371-de1e-448c-a607-17d532882128", "indicator--8ffc89ce-ce78-4afb-b9dc-03338e270897", "indicator--4321de85-cf01-4bbe-80b2-ecb8c217dcd2", "indicator--fa75abab-b9b2-45a8-82f9-97244c2f8a5d", "indicator--6729bdff-947a-405f-8a48-ca216109690d", "indicator--f3aa1db3-454f-4e2f-a4f2-05b0b8adb2c4", "indicator--826e0f7a-b843-4de5-986b-41ec62e51652", "indicator--3265097a-f012-4667-bd27-08db1fbfe65e", "indicator--8d31761a-9744-4c23-a12f-65f127a79461", "indicator--120e1547-351b-4960-8bd1-77f227aa09f2", "indicator--dadfd928-6278-41c6-adc2-c53cd16384ab", "indicator--45f46361-30ac-4bd9-927c-d8c3958cdb73", "indicator--d131e0aa-b1b5-4bb8-8f6f-e46b6725ce56", "indicator--df15d089-f990-4b67-a08e-0140589e24e0", "indicator--224ce1ec-4bb0-4524-b3b4-4949b3713923", "indicator--78e6cf2e-c308-4180-a148-bead5b64e0f9", "indicator--eecf3f61-86cb-4740-856f-11839c31b397", "indicator--6b71755d-b637-4d92-981e-f9d19e58ed8c", "indicator--b9b8e7f5-b4fd-492c-ba92-8f12b6c124e0", "indicator--c4e790d6-eefe-4c6d-95c0-6dad714048c7", "indicator--13b17a28-2fdc-4370-9e87-4ff693d3dc32", "indicator--dc697617-23c7-4198-b66b-487ea4d39d92", "indicator--a9dffc55-8392-42a0-b36e-35aed3f416b9", "indicator--01fe252a-6aea-4ccb-ae3f-89882bab1aa7", "indicator--e3461f90-6fea-4f97-ae31-a9f80ef57ec8", "indicator--840f6e5e-7b3c-41a0-923e-d3f4d5ed83ce", "indicator--992d42d2-664e-4ce5-a2af-607613392ae4", "indicator--49ea6f97-ac81-4e91-86ca-f37c58bc0da2", "indicator--1f83dd5f-7eff-478f-a58a-4229c039d11b", "indicator--29155b3c-bc95-4284-87f7-3bb06e06c212", "indicator--ef662a6d-8655-4267-9de9-58694f3fba29", "indicator--206eec04-27f7-462c-8ede-0927037b5459", "indicator--ff3c899c-cae4-4b9f-beb1-09c7552a3eec", "indicator--56e2951a-5793-4ec1-86cb-36d7d035520b", "indicator--4ad4b75c-a1fd-4b67-b78f-a04440431b7a", "indicator--6b505591-1e0b-4ba4-bee3-a0089deed010", "indicator--a4700f39-f9a8-4ff5-a792-a946c0c28712", "indicator--98225589-b508-4e33-addb-13e2b6cb172b", "indicator--7db30180-0b0d-475b-9c14-0f42697deef7", "indicator--92e977df-bc62-47a9-b75b-ca53fcda6a01", "indicator--db8a3c2e-ff4f-41d2-a30c-85c7f0adc2bf", "indicator--dbc644c3-526f-46eb-bd07-6fcd6911e193", "indicator--7bdbdcad-9455-438f-bd7f-c887ee043861", "indicator--91e6c037-1f90-4e9b-9468-213e24c7f9c2", "indicator--58796cb6-fbc6-457c-ba0f-79dd45c509ae", "indicator--f22dc6bb-e70c-4aef-ab53-9e85aebf70fd", "indicator--76370797-a59d-40a9-87c8-53d6cb518226", "indicator--86b44e11-795c-4b5b-ae90-56d1b48e5e35", "indicator--eebe465d-1442-4e50-8f2e-cfc5dac344fd", "indicator--732535b6-9709-4a01-87fa-fc0376aaf9e3", "indicator--701bb6ad-53c1-4adf-9c24-b0e1d7a19c9c", "indicator--8f92bb77-c1a5-4bfa-a0ae-5e9894952df3", "indicator--3eda8334-fc6d-47af-ba8a-4783a04c847a", "indicator--f3893cb8-deb0-4899-a28c-f2c79e473bcd", "indicator--b7119619-4cd0-4dae-aed7-65a255b48b76", "indicator--d71d01f4-bd7d-429d-a3dd-26cfe50dc0e6", "indicator--1ce40fdc-35aa-4590-a8e7-c0c3f53f764a", "indicator--98a333ca-2aea-4a83-86bc-7b674fd9bde4", "indicator--eb40bc6f-8ec4-456f-ab89-2d48c756bf01", "indicator--1baca231-b83f-43ac-9756-2bf8a72b94bc", "indicator--4fb0e6da-82a3-4f04-8958-b940514d4630", "indicator--b38ede7d-2d62-4053-af44-1401e9acd48a", "indicator--e71f1965-7952-4cd7-8867-b9a2e839f902", "indicator--b0a630a2-1094-43ce-b73e-2e60971da4ab", "indicator--a457b534-9fa2-4f6e-9f14-595b85d8bb15", "indicator--16761f78-3c45-4c5b-a277-acbd387b39b5", "indicator--5688b545-7e90-4f14-a2a0-b135504ab97e", "indicator--d4f33544-7fe2-42d6-8904-d65952505d2a", "indicator--05b59d8e-92aa-460c-aae3-5e477b1a904e", "indicator--e9ed6fcd-b1e3-4726-958e-24fdc8d73ed4", "indicator--45cae13f-3080-4472-b493-768fd8a5a887", "indicator--b9180b94-fdd2-4bf6-a2c7-1306e6abbe6b", "indicator--24024e78-ab03-4762-8b37-58f24ce0c777", "indicator--c5e42091-118d-4547-b5bc-05fa05011ef1", "indicator--4072841c-2e59-4e2b-ae7c-6ae7ce327eb3", "indicator--4e101669-60e6-47af-8fc4-0d392a874bf1", "indicator--90b23ec0-b132-4399-946b-06faf787ed38", "indicator--1cafbe4a-38cc-4c11-8124-c9e9b1a0cf3d", "indicator--12989d7a-b850-4a6a-a128-176f38e30a43", "indicator--afb1b6a6-310c-467e-b6ab-0ad9d087cbab", "indicator--04500178-c13b-4609-803a-4ce999377d9d", "indicator--7e72e47d-489d-4c57-a384-5bb210eccc7e", "indicator--01765d49-2870-4be3-8889-271c568b3eac", "indicator--48806c5c-ae26-43f4-997e-83f5c27659db", "indicator--f7d99bca-0370-42d6-a4ac-6af27cd86565", "indicator--bb14d129-9763-4986-988c-5e2662e0ddbd", "indicator--702ad605-c4f4-49b0-8860-527d87f87ffa", "indicator--fdbe10a7-605f-47bd-bd60-14ff27a14910", "indicator--e0e2fa97-60a3-4689-b728-b718290af738", "indicator--b8f67b0f-6a42-48af-8a41-40106aedb0f8", "indicator--691b3a31-c5a0-4a9e-b40b-e5ffa4d3a87e", "indicator--8b957d17-470e-49a0-98ad-651cf1b5d944", "indicator--2d9c326c-807e-456b-ba4b-5fe7eb472261", "indicator--aab4b75e-651d-4b8c-8791-71e75f766f57", "indicator--345e01c1-04c4-49d7-9d42-f3037bea00ab", "indicator--d3cf2dc0-3cff-4215-9644-dd3eee621de1", "indicator--04adfd62-79e3-4121-8555-6cf77fb8bc9b", "indicator--890670a6-ed2e-430d-a108-7f3418c23af6", "indicator--11f5f5f5-7a41-4b20-b74c-f11d08d8fc18", "indicator--369b6ec6-efae-4b52-bfcc-315bf06a1acb", "indicator--a18eb316-e015-4a3c-a845-87a6c6ed2fee", "indicator--7f755f54-4523-4b0d-8444-5ba2af2a45fe", "indicator--0f21ce17-af80-4575-8941-6c3a43b65a6b", "indicator--e7c39060-d007-467a-8b79-3a3eaecb412c", "indicator--d377b89a-17e0-45a8-88d5-e144a0e5f07d", "indicator--f3d30775-da2f-437a-8ac7-7d34d21e83ea", "indicator--851843c3-e3b2-4d35-9b63-da47d73630a0", "indicator--184f22bc-531f-4098-82f4-5d576f33a881", "indicator--7886b18b-c9a5-44b5-9415-c3a8aaf2c1d9", "indicator--57cd317d-cce0-45b6-bec4-32855772c39b", "indicator--3bc8778b-6563-42a3-bcb3-7c8959fb444d", "indicator--2bc4e986-5129-417f-96d8-772f07622614", "indicator--649b7371-20c9-4b20-91bb-766f006036cd", "indicator--13f2bc5c-27dc-4e93-8081-5d7247626a2d", "indicator--7f13d2c7-ebbb-4a66-b0c1-fbef568db7c6", "indicator--b440f6b1-454c-4d51-9ae2-2a0f7922521b", "indicator--f662656c-9df9-4b55-87dc-e25ba7b8d9da", "indicator--b7750c4e-6555-4038-9472-af8bfd6ea234", "indicator--25054994-eeb5-4ea8-a36c-f935c5369455", "indicator--5ec31552-3668-4f0e-988e-684bcdff840b", "indicator--5ffad1b2-3bb3-49b8-b208-4a61e328bb47", "indicator--fe1a3704-6d7c-478a-b473-7b60365e98e3", "indicator--b4df900c-3ac3-40cc-be0e-9cf2b9220126", "indicator--e5dd8848-c2c1-4199-9408-54718e739719", "indicator--71982165-71ef-4124-8ff9-321add574cd9", "indicator--849a2119-5f3e-4e87-a97c-633b039ca43b", "indicator--3ad6ca03-9972-4e0b-af44-081c6dd668c0", "indicator--e7312a10-80b1-4c96-8fdb-b5d9a327ce90", "indicator--0a481e31-f4f4-4b02-9069-d9f5ed93c319", "indicator--fb8b8d28-1835-4f1d-b4ba-2dd71967486d", "indicator--1261a371-e9b8-47ea-954c-35ec51071c27", "indicator--c9567d8c-1707-437d-94d2-fdaaeb53c5ee", "indicator--3af8d857-1546-4199-b1d7-f9a487f7f816", "indicator--4dbf9a58-adaf-4fd6-96db-c47b1256cfac", "indicator--a5fc00f8-1fd1-408a-b608-fbeabbd1d186", "indicator--9ed25618-89cc-4c08-b404-e6bfaa0173ce", "indicator--c59b4d2c-43d7-4e92-8568-5184cd9c11d3", "indicator--005e177c-6b5e-499d-8725-27e66699374f", "indicator--7305529c-8cf1-4b1c-a623-16356be64409", "indicator--b140cb68-2110-4a92-b99c-77cf6762fc37", "indicator--6f80d6d5-66ba-49db-bbbd-290e3e13f2fc", "indicator--9ff381b0-8dab-4014-8114-ee6b960c6801", "indicator--9eee05b9-5d28-490c-9e55-454c9e9dcacb", "indicator--4e7bf57f-5c98-4067-a92e-4d40f5332489", "indicator--e42caa6b-b633-46ea-b007-af967cf81710", "indicator--aa495049-6c18-4bf1-b610-2aa8b3f6632b", "indicator--a50d0203-534d-40ae-812e-540c3dcacb93", "indicator--613c004f-08e3-497f-8f72-3ca0180df4d0", "indicator--5030306d-f0f7-42af-99af-86f502b6c214", "indicator--37386a98-1b84-4c6e-be17-d77f6cfbadae", "indicator--9a4ba885-bfb8-4f4f-918a-5ab7842a377f", "indicator--65d0e282-48fc-43bd-9585-43c9a9aa849e", "indicator--b39a1e11-0179-4c98-82d8-0e1e0e85dc26", "indicator--ec1b6a64-5f9d-44df-b53f-61dd9a61cf5a", "indicator--7bf22251-f5db-4722-9ee0-f89ba94630e9", "indicator--b100b7ed-8432-4b8c-a596-291d06996969", "indicator--263418d5-b5a0-4a79-8335-c0ee9eb3e5aa", "indicator--9ac45d70-a0c2-4c4b-98c4-f9f68e0c8cf3", "indicator--30b241b3-04b6-49c9-b0b2-1cb061457bdb", "indicator--8e6b2b79-0675-41be-aad0-988128e60f1c", "indicator--1ea1cd9f-dca5-4d16-bfe2-fffd575d6cc5", "indicator--31ade283-ed6e-4fab-bf96-68921b0336ff", "indicator--ad0c1e9b-088e-48d3-a64e-2da1f30a8e13", "indicator--406a8097-55e4-4016-b592-34ae24e1b2ae", "indicator--7dbef670-784a-4095-b5eb-cbb87bd343b9", "indicator--50016804-abb8-4b07-99a3-3b2db5fa04f4", "indicator--b4237ffc-7a63-4ffa-a288-4e1cb9286fe9", "indicator--cbd5e0d7-211e-415e-9568-bc5d24c6ed19", "indicator--35040d9a-9643-47c4-a9b7-74d7894b996a", "indicator--09be2e6a-ba8a-46cf-b8b6-aa68c022f872", "indicator--ee1b919e-71a2-419d-84a0-a534d72a400c", "indicator--3f779444-07db-4d9a-babc-32349577ed1e", "indicator--4d7fec92-9393-4f37-a7ca-db49a79af25d", "indicator--d4f12727-6292-446f-b352-4543aca8a763", "indicator--3b78ef29-e9bb-40b7-b665-e046a4ccb89e", "indicator--ec14ece0-6595-4d41-8f9b-1945ab1c9084", "indicator--425fcaf1-b6ee-45bd-8373-962147ad730d", "indicator--e49b429e-89b5-45f0-ab4d-3fd1becdc5ac", "indicator--90c6fc90-d6ac-4d36-b7d6-8eb39a309784", "indicator--17830775-74a6-4253-a74c-4a19cd86049e", "indicator--0c3fc660-d5aa-41c5-9ef3-67dbe3da5b6c", "indicator--83af0fa7-5073-4dec-b782-20645b382cc5", "indicator--24042b52-91ca-414b-99d4-62de37e2a5d2", "indicator--8d116b84-53f9-4694-b619-6c232698dd4d", "indicator--03c2af28-03f8-4748-977a-65692e7c0657", "indicator--3cee16ac-f5ef-465d-b314-2822e36751e5", "indicator--027c6c08-8ae3-4467-bb79-cdf598c67aca", "indicator--e35e66fe-ae7d-48fa-870e-79308447a903", "indicator--49ed25d5-2194-47fd-ab3d-a9bae63f0182", "indicator--c720d03e-f929-44c1-8959-d80db9661cd2", "indicator--8e8e64be-5a04-414b-800b-40bb9a1bb62e", "indicator--de2ecdd7-a7b7-407f-b3fd-91fa06b99f94", "indicator--03d47908-1616-4392-934f-3d57abf341e8", "indicator--2040b1f9-1a57-4901-8432-4fb9e3ba57a1", "indicator--ffc1dac9-5397-4e9c-bc5f-181c9a26a224", "indicator--30ac66ed-7278-4036-9f7c-fd48829503df", "indicator--2bf6414a-bbda-4ce6-b75b-ed1aef90ae99", "indicator--79eb876a-b20f-4845-8174-7b584b71a182", "indicator--240d07e1-225d-4404-a814-7bb8ff8d6f56", "indicator--60ff0c90-f3c8-4714-bc41-143d2421420a", "indicator--b6682889-d544-4f67-80b7-7444099104e3", "indicator--0039da4a-0f1d-4d8a-88f2-e59a2f5a65cb", "indicator--070437ab-b986-45c9-99c1-e1194e0e81cd", "indicator--9ad47c86-44fc-4fbf-b48e-acae552ad5ed", "indicator--1364c833-af60-41df-a4a4-15a064075cf8", "indicator--781b65c0-c85e-4d52-9d92-74bbcc6e1b60", "indicator--5be6f6f8-b799-4722-91d5-fffd5c27ac5f", "indicator--a430ab84-d583-46d1-8897-bbdf1788a0ec", "indicator--c14e6ea0-9917-4690-8078-cfbce29ebc45", "indicator--f5f46349-6c6b-4d21-9a43-1f631d92e14a", "indicator--69ee7616-9a7d-4cc4-be13-8461676c6052", "indicator--adf90e35-b255-44f5-9dce-2cb4e2ec3cbd", "indicator--a0323be3-469e-4357-95f2-021343dcb181", "indicator--5823c35d-716b-49f4-9308-4fa21c5a5c53", "indicator--30e9da44-0716-4740-994d-ebf61c97a8bc", "indicator--27724994-29dc-48ae-8657-3729c6210238", "indicator--3d2eb533-a27d-4752-8064-f5e1e57f3383", "indicator--9c3e95c8-92aa-45b0-aacb-467a1c8a8c20", "indicator--f719997b-7f3a-405b-be6c-6432589bbac1", "indicator--f9e9a384-ab29-44bd-90dd-8f883f14519d", "indicator--7914d932-6a50-4ae9-8eb8-b646b51d889c", "indicator--82bc2302-5c25-4443-b155-6338a449760a", "indicator--981365ec-f296-406c-8766-392d9e0bc190", "indicator--75bd1694-2b97-4759-9f70-851a4e9c2045", "indicator--6cd00247-641a-4246-bdf9-1670c295ebde", "indicator--e3930a76-b8dd-43f2-aea9-90f9b8b9271f", "indicator--e424c2d8-256f-4d47-8f8f-161dff22a2c5", "indicator--90917e94-f24c-4aa4-87bd-3dc83632367d", "indicator--83f54c1e-0ae0-4680-8766-5fda1b3e2c1d", "indicator--40212981-7b83-4eb4-bd97-bb786125aede", "indicator--3b2cb6e6-ae04-419c-b9b6-e72ffbfa87dc", "indicator--5741ce02-d05e-4952-baa4-28dd1b6ed611", "indicator--aad6e751-59bb-4e2a-a54c-3e52fe2f39bc", "indicator--e166c825-49b9-4ce3-9d33-ce0898e10dc2", "indicator--8011b321-8bff-4e49-8b8c-99b8386b0868", "indicator--e74a3bc9-dcc5-4582-a43b-0bb5e97d1538", "indicator--1cc35c73-3860-4649-ab0b-57caf93fb20f", "indicator--e0b88790-5938-4221-bfb7-d1e536404211", "indicator--63708f6b-814c-4d23-b6b3-165327cb8e81", "indicator--b65ca8d0-d7bb-401e-8fd7-8b047db60aa3", "indicator--5ca6aa66-301a-41dc-b8da-21e207423ec3", "indicator--112520ec-b216-4420-bf3a-7e7fa8559a2e", "indicator--668c26b5-02b0-4373-886a-7b7f05ddb07e", "indicator--e8c3cf03-6ec4-4ff2-a98c-ad94a8ee4dc6", "indicator--405a3729-c41b-4176-8152-f96246d7bf34", "indicator--ca885dab-d2b7-4dda-8ca9-457526968c87", "indicator--a7809cc9-9d13-4d4e-9d8c-ef8c2e99164d", "indicator--fa975d0f-d0d7-43c0-929d-5186272fc085", "indicator--69f6b8e0-7dc1-4f2b-a6d0-7dd4c3c52202", "indicator--f8d838f9-a288-45b6-a605-a8bb91cbf37b", "indicator--05a82a48-e71d-4a65-8bfc-8dbe87f4be8a", "indicator--d0f297b9-70dd-4624-81a0-15dee4592d6d", "indicator--b13283ab-6bfe-4bde-aada-0d1db1876238", "indicator--880ac684-a80f-4f63-b73a-606da781ad4c", "indicator--f401bedd-19d9-4eba-8250-16d655fb21a9", "indicator--d846f964-3465-46e2-9113-45e52c954ea6", "indicator--b9524867-8719-4f23-8c43-dd63c6c6b5ce", "indicator--93188407-f586-4cfa-b4fe-3dd588816842", "indicator--6f60b784-297a-4660-99ba-a16a437d3a5b", "indicator--57939675-c347-4b2f-868d-25e2057b996b", "indicator--fcab8268-c2bf-451d-87b0-e6f9e441c69c", "indicator--90c9b287-feb4-4375-9cd6-94d1a3dedbe8", "indicator--8e31ccc2-d336-4afc-bfbc-3fefffef8a1e", "indicator--82b59e6b-499c-4b02-aac9-1f27c24cff78", "indicator--e6ff7ada-9ee8-4392-9449-d01422ebb213", "indicator--9369696c-2f35-4699-9a34-b52c9b8b752c", "indicator--eca2de76-ff2e-4eaa-bf78-9b945a143f4e", "indicator--c3652924-7da6-48ef-9c9a-6d51bb8eb1d1", "indicator--b76ee372-d0a5-4ba1-8b50-8581fe3aead7", "indicator--d935f821-4d7a-4ec4-9ace-208bcf1f5ddc", "indicator--0dccbad7-1e4f-48e3-b425-399995353f92", "indicator--b621ea52-4d66-41b1-988f-a83f8fb37d03", "indicator--e9efd717-5757-4f2a-8eaf-811f4407c846", "indicator--f11e2659-9084-497f-bc52-81ff25e2afad", "indicator--1ae965e9-a55d-4883-8b65-0c8a60f4ab43", "indicator--ebae73db-f075-4332-a3a5-d56270eead3c", "indicator--ecf5f682-92ff-4e1d-a011-0a0575f8c9ab", "indicator--b1035a57-3625-478c-9a11-06db93146f1d", "indicator--123df22b-47ff-489e-baa6-add3d66e3869", "indicator--04d47502-0c4c-4067-b824-dd99070e4681", "indicator--b800d5ee-89ac-4772-b558-a91055b28b56", "indicator--098f7a3e-0c71-4e6c-b17e-496e7fc861ef", "indicator--f426ba86-c0bb-4c5d-9af2-cfcff8873cae", "indicator--805de21e-3f53-4bf4-9ecb-01d63f2f358f", "indicator--2a5aa8d1-caf1-4d81-9055-7c5e8e8cc3d0", "indicator--89b14441-ad41-4ba4-a754-4a671944ed5b", "indicator--b9a2cd7c-ced9-489a-9d26-68a77340e7e0", "indicator--2020f53d-614b-4ac2-8a6a-70149cfa9564", "indicator--6beae9d0-68c9-43b5-867a-983030dc101f", "indicator--1bdc804a-dcc7-4c74-9ec5-183f09dfecce", "indicator--97aa1704-533d-4baf-ac82-e9e0e0d9899f", "indicator--a5101d58-d456-493f-bdc8-755bbdd90c3c", "indicator--46609a1a-219b-4dcf-9335-e30e537ca0c1", "indicator--1a2c92ce-a1d6-411d-b337-30eb93d582c4", "indicator--e252e079-ea04-4279-be53-b1014fdb4b1b", "indicator--4f12faaa-0f36-40ec-abad-264b0c4ca065", "indicator--12794e38-4635-4a72-b960-7f8952fc15b4", "indicator--091b51bc-5006-41b6-891e-83cf60320bc5", "indicator--28a211b1-a504-4d3b-ad76-1a48aec61baa", "indicator--d109d7cb-48a2-46bf-9eb1-98f8f0a51414", "indicator--40f246c2-c46c-40e0-ab90-4c4b22942184", "indicator--692213b2-fde7-42b2-8d0e-3550472fd7e8", "indicator--c35dbe09-f31f-4b05-857b-27587f68f37a", "indicator--864e5d28-d378-4f96-bd29-2fbf7a0daa35", "indicator--42634b8d-7a1a-48bd-ab19-8cc89a2753fa", "indicator--af479bb9-2186-4d4e-a48c-e6bc0ee8a0f3", "indicator--1cf45aba-e783-4191-80fb-80ceb03bd1ee", "indicator--d766ffa9-542d-4c84-8394-5085543d2b86", "indicator--59142ac5-42ff-4868-ac44-d8551d242456", "indicator--765eba35-929d-45b4-96c8-bd3e757f4d01", "indicator--334d595d-7e45-4770-b282-e7d4a8c247b6", "indicator--e600a14d-2c48-4b33-b99c-2fea1fe0c1e4", "indicator--b843ecdd-4f9d-4b29-b206-f55dc3cd2ad4", "indicator--6e29072e-c78d-44fc-b152-89c3179b2031", "indicator--10dd6753-43d9-4a37-87ae-44817f8b0e9a", "indicator--5aaffa78-c95b-4210-b018-d4d270b4195b", "indicator--f14b7557-82da-4f64-8187-0762e3ce2449", "indicator--2d118126-ed2b-4c3c-a4fe-76bddd16525f", "indicator--1da6f856-71ca-4d06-b59c-6f4ed67f5b5b", "indicator--80240fd9-487b-4b89-8fc5-f986adaf2ac0", "indicator--53c0b28d-55eb-4934-b0e5-fce08cef934a", "indicator--77efad9c-82e3-406f-91be-1bfe97c40f74", "indicator--3e0935f3-cc7f-4d5d-b51e-a177b22934d9", "indicator--f6e22157-3458-4cec-b5ab-7d1ac96556fb", "indicator--03db3da5-cd3a-4236-8894-f6c50bcb0fff", "indicator--725fac81-0608-4117-81c8-71bcc94db6cf", "indicator--8bfc088f-4afe-4e15-877d-7998d5499616", "indicator--fda5a00b-f4cf-43c5-9a64-0fd1291c03c2", "indicator--59e86da0-1dda-45d7-a5ba-8142488d911a", "indicator--5e33dc7f-3709-453c-8b93-c453bfaf6cd2", "indicator--3198edbe-7735-4b7b-83dd-ee7ef7ff2644", "indicator--e19cdcdc-f3c3-4600-b71b-6da812c5ec45", "indicator--8faae79c-27d0-4ef5-89c8-1f0c48e478a4", "indicator--49296c74-04bd-4daf-bb6f-8ae1e901cb94", "indicator--d3975455-c017-49be-b52a-7d302da65fad", "indicator--1dd70f0c-819b-408e-b6ef-ffb507511b12", "indicator--0eebf057-5fc0-4c05-880c-4b6760b43bd7", "indicator--2e05bf7e-4854-4666-89d4-d6e870a5c13f", "indicator--c1827c44-d62b-4662-91e6-c83e4247a035", "indicator--f738fc77-44b6-4e74-8135-5739d650426e", "indicator--e060d6ce-d0e0-4870-82bb-46af8707774a", "indicator--7ebe00a2-c09b-4160-a7fa-19f97644adc1", "indicator--1417a48d-39b8-493a-9114-05b4daa88f8f", "indicator--99d7bae6-0399-4b28-b9d4-445c3d8f7852", "indicator--2cfdb714-83ca-4a75-9ec4-471c7988aa92", "indicator--1d1c43c7-c62a-4ce7-a91e-94f460544225", "indicator--53d0795d-b7aa-4763-95e3-0ada4714bfbd", "indicator--b172087f-8847-4a10-8077-066fb63488a1", "indicator--63da1403-935d-412a-aae3-1cfb10c5054f", "indicator--ba2d5ad7-ceb0-4959-b442-461785d79081", "indicator--96b5a199-e3a4-4170-b17a-4142c122911f", "indicator--40cb7bfa-143a-466e-a3d2-1393dcf59fa4", "indicator--114fbb80-da32-4103-8aa2-d8c3e86b1d48", "indicator--1e28aebd-5618-465a-bc2d-0a85190944d9", "indicator--5bc1cc34-9a1f-4c58-82ce-d32be73648f3", "indicator--70f69b85-9d7f-4886-9cb8-58b6e59a2325", "indicator--318b02f0-11bf-4b67-8089-4f7fad33d67b", "indicator--053cb58a-ebfb-43ee-af64-b9e41b1dedbc", "indicator--eb477f8d-7d6b-4e59-a6f7-b920c6ab3d44", "indicator--59c13477-78ed-4a6d-beb0-35362be1fc68", "indicator--a15c0b51-8182-466f-a5a9-79e2d6914cc3", "indicator--9d3a1464-403f-4ae8-94cc-8450ef986f49", "indicator--2d4d2069-153e-46d3-ad84-e436404f2104", "indicator--a9765245-0941-44c0-bf02-a1ae1ad9b17c", "indicator--4d280688-aa0b-48ce-88c3-ad4599d7ef6b", "indicator--18c03411-3580-4fe8-8add-21c555e3dbda", "indicator--b13e89ea-e9ed-45d0-a9b2-008494f4cb4e", "indicator--e5c85990-3102-4aa3-9a84-22583359cd66", "indicator--ac2f83e4-be8a-48cd-a38e-ed961cf4231a", "indicator--5eb89606-d902-43a0-849a-0f64755009b7", "indicator--bc98e37d-6a2c-46ed-af5d-be10cb11da46", "indicator--16dbf4c8-ba65-4f75-9fe6-84ba905a2c45", "indicator--ea84f678-d87e-4fdd-ae0d-07343684d32b", "indicator--663026de-0168-4810-b0bb-6c655d13188d", "indicator--d14ace10-935a-4b2a-88d2-69d9313d48ec", "indicator--b35e5896-91e5-4b26-82b4-9632e6a0a10e", "indicator--4b4aab2d-0032-448e-b598-d356ca1db3b9", "indicator--063d7492-d645-4392-824e-e838d23fb5c8", "indicator--679e6fcb-1102-488e-baf3-c88b83bd4d6d", "indicator--0529c063-9171-4258-9fd3-7f7783f84331", "indicator--b93ccb92-98f8-42fc-810d-22f1eb1b100b", "indicator--e47a981b-0ef9-4720-9411-1f435100e3b2", "indicator--c89a3736-1d48-4949-b38a-b74a67a6e079", "indicator--cf0b1f0c-430b-422e-9bd7-0ab19dccd435", "indicator--e3bb26d4-908a-4fd3-b6ec-def01acb4657", "indicator--85beefde-0bd6-4af5-b03f-e2b9f6bf8271", "indicator--8e0f1b9d-c9a9-4bf6-971b-4566371081ce", "indicator--08251877-3160-4afd-bdaf-4f5b5f4d8dab", "indicator--80792d65-bd11-4cd8-8e58-773d7781b884", "indicator--2fb8b0b4-369d-4094-9a59-7a2a48d9efea", "indicator--47fb948f-7f7e-401c-b3df-93b1960ae139", "indicator--08c9a934-4dee-448d-b24c-8600657028a2", "indicator--088935c8-2d78-4727-8061-06c96f96edbb", "indicator--69211e51-c41f-4945-8538-b1f4640930b6", "indicator--9ac4abde-dcf2-4817-8170-74bc3bd1e488", "indicator--a812f1dc-a0f2-47fc-a003-253c6515134c", "indicator--8d3799cf-0084-4d5b-943e-8e3f301ce6d0", "indicator--492bff5f-847c-41a9-bd9c-ed89e621a976", "indicator--4878620b-2e5a-4ea9-aee1-c8f15f74bfb3", "indicator--18fb95cb-f084-40ce-9a83-99e526881beb", "indicator--6c353db9-8e8c-482c-86db-a9f4198de778", "indicator--554434b0-6212-4483-8f2a-0ab655219416", "indicator--75669c95-14f8-4299-83a4-85a30d0c8c2b", "indicator--91d8c69a-a2d7-439c-a7ad-e1da249b7a0c", "indicator--237b6c70-14a0-46ae-bf3d-538f8eae9f97", "indicator--9725b27f-8839-43fb-ae40-88a2e87dec19", "indicator--66308229-ea97-483c-8436-927627d1b6ad", "indicator--2a128b98-93f7-470f-bb7c-46d5795624e0", "indicator--8817d205-d67f-4cfd-a2e0-690d3118bbd4", "indicator--d8e19ff9-ec32-4c89-9b11-6c2bfefd7494", "indicator--939e6c65-1901-445b-9251-2b5b0b656a02", "indicator--49d9594a-b41c-4d1b-aeb8-7b8c279a821c", "indicator--94b22b93-80ac-4dbe-92fa-1c1688022cb1", "indicator--a1b7279e-0f26-4e29-9611-d1d83c2d831b", "indicator--c78871df-8a5e-4271-9b48-c779d58d1252", "indicator--d5db0f78-6441-476a-ad90-a4431ff5a529", "indicator--970e320a-54e0-4190-afad-73b5c3ce648b", "indicator--7ea683d5-5e45-4b7c-a4cb-404eb6f19fc9", "indicator--91ce2e09-d062-421d-8907-072880d58ce7", "indicator--5b6c6dcd-9f6c-4c00-ac77-4768b178db22", "indicator--cf816106-766d-4d52-8dda-67483570a2e8", "indicator--6627a7da-5427-49bc-a685-28366c219896", "indicator--e94e79b6-ff93-4569-9649-40cf198e6fff", "indicator--e7361804-15ef-48e9-b567-4ea6fc8a45d4", "indicator--e92d145c-72bd-45be-a18e-ede773cbd1a0", "indicator--0e373f46-f4ff-430c-9d0d-562950a7ceae", "indicator--4cfff31f-fcea-46d4-a2d5-0577e744adff", "indicator--921e8bfb-cabd-4472-a53c-75e96eadb9ec", "indicator--ec90014f-c3a5-4a9c-a035-31d5dc85ddc8", "indicator--52f35cb3-c480-4066-a70f-bf8f2117ff54", "indicator--474d0997-55b3-4fee-8c06-a51c6530714a", "indicator--efd215fa-6ed0-4947-9398-ae09d9765cd8", "indicator--9574797d-02cf-4ede-b85a-89548e2bade2", "indicator--4371a98c-a105-4751-8f69-3a5f6f6fe1f4", "indicator--5387f377-5b77-4d6b-b2ad-24f0cd34ef6d", "indicator--32c2d106-4b09-4779-9582-01a826906bf6", "indicator--2a967ec9-a365-4ef2-a3d4-df21c09b11ad", "indicator--07095547-99dc-4b68-a493-4f194a633427", "indicator--5091dc7d-161a-4fbc-9441-0ba8f95320bb", "indicator--b7118ff8-4dc3-48ac-b9c4-5df5fdb63837", "indicator--a56f97b8-fac0-48e7-922e-eb344a23dc54", "indicator--8d58d9da-1ed5-45da-9363-cc2327abca33", "indicator--54193180-b290-45a4-855d-67097d9dc143", "indicator--bcf9af7c-d52a-47e1-bfbf-6269a5c2cc2c", "indicator--63f08cf9-8965-4a87-ab21-e61c429f27c2", "indicator--ba2b4556-7a78-49eb-a941-762bf48de944", "indicator--4b75d444-e661-4e75-9248-27d984f7dfe9", "indicator--f8dc0ac5-85fe-47b2-92d9-a06317be7b8f", "indicator--cd5076df-bddb-4320-bd33-96840c8d1b0f", "indicator--7d2b6d15-34c3-43df-ab48-86632e19a1aa", "indicator--27104ac4-e66a-4df9-a374-7c28454abdda", "indicator--dcdbd6b9-2da8-44ff-8b83-04127aaa5927", "indicator--15494ba0-de8a-466a-b0f0-7ea941d9ca75", "indicator--50faa63f-b8ae-4977-9d9b-7a924e3060db", "indicator--34e582cb-ff8a-46e7-84ad-983eec7dc49a", "indicator--9f940554-ab57-40cc-853f-7343e7ff3399", "indicator--5a815999-c247-48c4-83a0-c0d1bce5dbe4", "indicator--78ffb079-ea43-433e-99d7-173680f246e6", "indicator--3d79495c-f314-4561-b849-0b4c5bc74fe3", "indicator--c82ca90f-675c-4713-8e7c-0d73adc122b9", "indicator--81bb6f7e-6078-4f28-9342-68239cc338f5", "indicator--9667b587-f3f0-4e82-9526-1babfab70925", "indicator--91f85213-dbec-4c55-976b-1bcd9a4adeae", "indicator--2c4a9d65-238b-4380-a47d-ba819d5668a7", "indicator--e4063b88-b178-4617-9125-9b3d821725c5", "indicator--8501491b-7e72-4f3f-932a-b9447d517a7a", "indicator--adb35488-666b-4717-b488-7fd1159eb114", "indicator--700dae45-da31-4719-aeea-fd1e18f23cfc", "indicator--fd49fc7a-d96a-4257-9c8c-928bd546d356", "indicator--3b924dc8-49a5-4644-a283-c8c9fba22380", "indicator--ce011ba8-9cc2-4b13-9555-0e4bc4c1779f", "indicator--308fd7d2-36f9-46ce-b66b-36348954078f", "indicator--9fb13314-3b63-46ed-ba7e-3c0b973792ec", "indicator--5a591082-ca5c-44d2-8fc6-5c60a4db48d2", "indicator--b83eabce-888a-4381-b199-14253092418d", "indicator--5af34cb2-e87c-4658-9508-7c77b8bec18b", "indicator--92afa932-b174-4c22-b94e-75c8150f61eb", "indicator--d0fbc85e-57b2-4639-9930-88486a91cfd7", "indicator--e005252e-f4d1-4fdb-8cc6-e21286478072", "indicator--9652fdda-e789-4609-8f35-c943ca29b38e", "indicator--8832b80f-9c64-4158-8875-98e212b40174", "indicator--7e02c676-765c-44bf-838a-9643665f4d9e", "indicator--957d1d1c-e461-4cbe-a613-ee9e09074b72", "indicator--513900a1-ffa1-45ae-a52f-0bbc9bda3011", "indicator--da57c663-66ba-4b37-8bb9-26e76a8e3871", "indicator--08253901-ef78-4278-8fe6-9c66f011a47e", "indicator--fc3e4bb0-da78-4b2a-9f5b-1e3d80ffa082", "indicator--34a795a1-ead6-4ae1-973c-e40f7e5b139a", "indicator--b6ed75d2-c053-4e97-9c95-ba758bb65936", "indicator--9f602e03-129c-42eb-8759-56c2a81712d7", "indicator--dccadca1-436f-4076-8be1-5fac8b90c661", "indicator--5204d3bb-1c28-466b-80ea-2818fe6852ec", "indicator--2c42ccdf-eadd-40f3-b7bb-eb9285b4faac", "indicator--291203f2-02da-40f7-8a54-7e3b17a52e9f", "indicator--57f6e17b-c935-41d8-9a22-0031f10ceefd", "indicator--0eff81bb-89bf-4db2-8c1b-25d547385e78", "indicator--a7454428-5579-4ce8-8395-9172187f9dea", "indicator--27c6a5f2-fa0f-41a5-9fb3-c823d3246abd", "indicator--ec07c641-e2ea-40e7-8289-e53e2eb6b6ff", "indicator--bd0cd65c-86d0-4ec9-af48-0c611dcdf739", "indicator--be3fc36e-03dd-4baa-a336-aa99cc11f65c", "indicator--651c7a9e-525e-4bff-8982-9e3c8b786b30", "indicator--779c8568-d5e6-4257-b260-732feb076dfa", "indicator--d3415618-fea0-4c6f-9c81-bfd76382205a", "indicator--419a4e76-3e7b-4673-a966-ba66e3009882", "indicator--31627d30-201a-4c38-8ecd-a5ab62f9cbc6", "indicator--803d9a35-4818-4372-91ec-facea029da6d", "indicator--5915ac9e-48c6-48d8-a02e-2ec573af9bbd", "indicator--f2f225d4-6645-4b65-a6c6-46bf8dd42a94", "indicator--35ebfa27-1381-438e-9b93-616d121e6f99", "indicator--aab9c6f6-3f8e-4239-bc84-9672dad1e67e", "indicator--296efee5-cdca-406a-a211-edee88f775a4", "indicator--54ff3165-f259-4fa1-b461-c131aabdc68f", "indicator--cfed9bbb-7c24-4d85-8c54-4fcd1b4d6469", "indicator--8c99d4af-cc6a-4dd5-8734-e12e7b41ff17", "indicator--cdd3cd0f-ff2d-412e-9b6d-cf63b0e1d118", "indicator--d0a98bac-ad67-4d4d-b561-8c01e0618d44", "indicator--94b5aa8a-e263-44aa-bdf9-79e95844e06c", "indicator--86001c56-d7f7-4242-bb46-4cba2b2ecaeb", "indicator--1b6ae1a7-f865-454f-abfc-69684a38c0ab", "indicator--d5333d83-a377-4357-841a-13583659b120", "indicator--50edcbbf-63d5-4822-8db9-ecbbe0687dca", "indicator--e8ace709-16b3-4c6d-9ab3-417c3e4ea0de", "indicator--43b7f3b5-ae5e-4727-b401-4a8df5c6f667", "indicator--a4624e17-0573-4214-8585-0df54f3cc642", "indicator--064d4fa1-162a-4f24-be6d-bf01522afbae", "indicator--93f85c44-8d8b-41f4-a33e-d4545c24295c", "indicator--b7e7679d-a17d-4779-b002-427ede85bdc3", "indicator--81c2bce1-0ce1-45e5-b2ef-be63a5071308", "indicator--18b5723d-00ee-487e-b5b9-71e11f8c43fa", "indicator--cae6d840-f4b8-44ba-beeb-7ebbb280998d", "indicator--62eacae7-1e5c-4f27-acd8-191712ca56d3", "indicator--002dfef7-84f4-46c6-87a5-30e1802da46b", "indicator--6a050021-8989-44cc-b658-0a70b79bd93e", "indicator--edda5aec-e0f2-411d-87b3-0ffaaff92ae6", "indicator--57c2872a-ec50-44a7-85a5-20eea0159b4a", "indicator--eef3a22f-6002-43c0-b405-08945f07b8c4", "indicator--b5ecf61a-3068-42a2-aa01-3959274c0b12", "indicator--a38a0603-30cf-43d7-8787-d3039445a0e9", "indicator--6fbc872c-76ca-4d9b-8c2f-c53177d5c716", "indicator--2fd407a9-9ad2-4190-ba02-33ee4e471006", "indicator--9ed00b6a-1c1d-4311-acb5-ed5a22409f19", "indicator--a201f7a4-e43b-4ca9-8236-0f3724a4fe98", "indicator--8eb65f9d-efe2-4ad4-8988-fa0c7eba6a7c", "indicator--61407d8b-2569-4f53-bde9-be4722812844", "indicator--7ad3d069-85c0-45d9-8906-a90f9200baa0", "indicator--e9533234-7fa7-4942-8ae7-b3e2bfbfbde0", "indicator--5cbdbb42-fa80-495b-bee0-d9e753bbe57d", "indicator--6575d3da-8c4b-46b3-827b-007046cf3abf", "indicator--3b534eee-9617-4fa0-a7cd-959c4f71e38e", "indicator--6c0802dd-9dd3-4034-9be2-cbf475adccdc", "indicator--4244591a-58ac-44de-849a-61203859d021", "indicator--5584ea17-abcd-460f-bc18-e018aabc7439", "indicator--f9160526-822b-41c0-b5b1-e15297c74c04", "indicator--d3dccc6e-5796-4e24-8dbf-2bb214f967eb", "indicator--c54d3188-9a3f-4ea8-84f1-d17e73ffdec4", "indicator--dc9f8bef-9fa4-4c50-ad3f-802a04d6ea1c", "indicator--e6bbc641-ffd9-4cf5-92ef-1f69d61414b6", "indicator--fab61874-572e-4797-8e72-6cc8886ad320", "indicator--87729b82-fcf3-459c-ac55-cb2038f9ec56", "indicator--a99c2c1e-338a-4cbc-be26-fe4e90c92a82", "indicator--1c7fb0c2-87dd-4362-b998-23a30cb98e6f", "indicator--d3f4d21e-2589-4691-9714-5771d2d98900", "indicator--b710e0f6-a17e-4098-a75a-7c7771659859", "indicator--b72b3777-a46f-4861-8849-06a98db09cad", "indicator--71fe5f4b-4ae8-4832-92d8-9665100b0a02", "indicator--45397d56-f4b5-4721-89b3-08609cc0bae3", "indicator--395e3d19-0b9a-4ccf-b476-6c878aba73e3", "indicator--78a9f292-ceaf-40cd-8605-fbfd09354061", "indicator--eeb838c3-4a2a-464f-924e-717caaa75ac0", "indicator--3add87c7-1fe2-4802-8336-7f5196904e87", "indicator--6ab77467-780f-4429-b9ae-7be31932480d", "indicator--2b45a4f3-a3b0-45bb-8470-6f135cfc35d7", "indicator--ea6233ab-7960-41b8-bb51-907b1f3769b4", "indicator--b5c7d485-0c51-4ec8-a66a-76b15216b36c", "indicator--7e6c8886-96bb-40bc-9450-ae5d6651bd6d", "indicator--521c685c-663d-4132-8cbc-f53151cb4ae1", "indicator--6305ab09-7223-4ea4-8bac-710994c77c5c", "indicator--3e04d898-0135-43ba-a6f1-0653b5025dd3", "indicator--af3ef458-17f8-4188-8699-54f7b95b8a90", "indicator--2515ae17-2475-481d-80ca-e39b153e340c", "indicator--99ecf5ea-0c7d-4485-aa30-d50d87d8efab", "indicator--49107313-d04f-45a1-a242-8b47c1c559d2", "indicator--ebd9138a-5b2d-40a2-a286-ec3701b4fd5b", "indicator--902ec467-4f5e-4bf2-81a0-242c4d7bc143", "indicator--a8d94754-9b0e-44c3-8172-7d3205024e65", "indicator--79a63fd3-8682-4314-a048-14275528fd5e", "indicator--b230055e-1858-4e1d-be26-231804ae0874", "indicator--13cd20a3-803f-432c-a9f6-524b391ece17", "indicator--de01f2da-368f-4c7b-af0c-88db8420888c", "indicator--55689743-0552-41cb-8c34-468d2d6016d1", "indicator--5f01f58c-d9a2-4f0b-9205-5c261300337d", "indicator--5d106a3a-da00-405d-85ff-91108b71a96f", "indicator--98104bbf-b34b-42ed-87e4-7bc664b11e5b", "indicator--a7f44473-75a4-4e7f-9ef5-a3c7f10cada5", "indicator--bef7d4c7-2b4b-419c-a9f8-7caf66588e22", "indicator--c6f7e012-4ec8-4c73-ba04-8ac9012c3075", "indicator--2bafa0bf-5662-448e-a121-df2824bcbfdb", "indicator--ada51a8e-caf5-4985-ade3-dfa74847596e", "indicator--fbb109e4-9e76-4a25-843b-060fcf2fde1d", "indicator--91d33a41-1090-41cd-ad61-d22302ce1ac5", "indicator--709fa3df-3ce3-412c-89db-3cc712fc91d1", "indicator--9e8563ed-d7ee-46f5-b141-dcffb85c7d4f", "indicator--08981a98-364e-48c4-9ead-70bb42bd731a", "indicator--795d9aba-5772-4ccf-b678-950b933699df", "indicator--52feca0b-0fe0-49f9-b55c-587a7034ae92", "indicator--9800e6a0-89b2-48c6-b355-e7008e972069", "indicator--997e23ea-bd74-46f2-81f5-5f745c647784", "indicator--3b3ec771-633c-4480-8906-7e2bca1107af", "indicator--8ace53be-0cbc-42dc-8c7b-212184995f2e", "indicator--1f07e996-be74-4173-a0e9-b65c790f18b0", "indicator--02024d6e-b503-4e39-b050-f79e8b7f44ff", "indicator--837ddb68-fec1-48bc-9ad6-71c5ebbb6b7a", "indicator--f37b6699-4ca7-46f7-842a-cf252bb6d2a4", "indicator--9ca28ce4-2075-4a49-ad18-313bccbd8218", "indicator--89fc2756-514b-492e-868f-6bd2c94a9706", "indicator--2b145e2e-b092-4b18-850c-5ca2e5b6b9c1", "indicator--8fbee8f8-716b-42d9-8f69-ea19644d8770", "indicator--bfc89710-6c34-41d2-b41a-cc49e1259b53", "indicator--8b0ed8b5-a127-494e-bcca-1878e01b4bd1", "indicator--f25c9f26-4705-4f8d-8b5e-2f432d6e0e66", "indicator--3b6b59db-e57d-4ce8-876e-00da0868fc75", "indicator--bc6addec-a546-4316-b3f1-ea2c14156eec", "indicator--bb6a7e6d-0fe9-4c75-8ded-9b3cdf86deeb", "indicator--62583c2c-368d-4e12-8d89-894e1e87a7ff", "indicator--041f7896-b0a1-4ae7-9760-864708537b09", "indicator--b14c2094-9cef-4dfc-9b44-8f9b2983c87e", "indicator--edaadc18-222b-4820-a234-41aad6f6300f", "indicator--b9c5d95e-35b9-4f00-9228-079f6ae7ea8f", "indicator--c0405438-1c68-4560-97f7-5b7e0720a82c", "indicator--724b46f3-ce94-4058-9c6f-4e86b80453a0", "indicator--f7510288-5436-483f-99c4-98a02ef5158d", "indicator--159983c8-02f3-4fc0-804d-5e46a905f030", "indicator--12e11fe2-e494-43c5-ba85-3c6c7e867bb1", "indicator--b9bd2a09-f737-4746-bfa3-dd755c635caf", "indicator--c7887ae7-b544-47a7-bd2e-f0988c13c4de", "indicator--da962ebd-fc2e-4c4a-8395-c44cf837e7c3", "indicator--4b97ee1c-59c2-4811-a947-bbb1389b9979", "indicator--e3625031-6003-4e4f-bf39-4c5a0e91663b", "indicator--45c5706d-19c2-47b6-8322-4a557e1ca1f7", "indicator--8b11e709-4ca0-4552-8bea-d99f5a754ae8", "indicator--362928cc-39c1-45a9-abae-5ca2ad2d0b95", "indicator--e9824177-684b-42a9-a66f-ead660407e56", "indicator--18425b44-3e4e-4653-80e0-aa66674a10b2", "indicator--7c71a752-0138-42cf-bee5-2411b869707c", "indicator--d319a31c-170d-450c-bc05-8ca71d1528c4", "indicator--9c7a483f-60ab-4ccc-9b0c-cb9fb950e60c", "indicator--0c693507-1378-4b79-8586-b1bed2b93eb1", "indicator--053c8d4b-624a-4a67-a066-0bc0016f5047", "indicator--c734c3c9-8def-4676-9d20-f23506f86202", "indicator--f28e913f-1dd6-4004-9348-1c7e34922e54", "indicator--68610741-7928-406c-a977-357ca1475d48", "indicator--1276648a-e5a7-4118-b0b7-bb408dd91d9a", "indicator--47f0e14d-de74-45c1-9b6b-4e1053cb5453", "indicator--32cd08ef-907d-4953-bbdf-2d3019391f81", "indicator--02526221-6953-46b1-a8b4-a46520d4e1f8", "indicator--efc1d7cb-2c99-44b4-ae04-bc7fb3f465f4", "indicator--0e27c742-9b5f-4411-92d4-c38395b224f5", "indicator--2239bc4a-9365-497c-a263-d0a35360410d", "indicator--5a5dd8d1-38df-47f4-9c5c-5c96fee3507c", "indicator--9de20e70-d8f6-4daf-9050-1085f5144f81", "indicator--08f2f37d-2e6b-4500-ae44-64c432374932", "indicator--7c8d9a58-cf9b-485e-93af-09a708b95403", "indicator--66ffb6b7-e9c3-4c24-88df-37c717317bd4", "indicator--41b3d603-0d65-4cbb-a838-52569c1a6baa", "indicator--a1db8dfb-c423-461a-9a49-8216020464f2", "indicator--f38641e3-f16e-4cb8-89e3-82fbff1fa265", "indicator--02f73420-781d-4db2-a95d-ba28df8a12df", "indicator--341bf7b0-43da-4d5b-846c-f3233baec632", "indicator--d5c77333-be77-4625-ab2c-4b262d8cc3a8", "indicator--a0d2655f-fac7-46db-b832-51c8fe7d7bd4", "indicator--2f142614-8cde-44b5-bf5c-451e36165fd5", "indicator--6d06d348-7d07-44c6-b431-a9cb75c2a869", "indicator--1c1fb170-3841-40a2-bc3d-28796ca5c872", "indicator--c347a5c6-aefb-4829-a3e1-40fd0cebc931", "indicator--5766d46c-66ac-4ff3-857e-e5bc48034dec", "indicator--cb386ffb-a41a-47f7-951c-e20ddb81aec9", "indicator--2f688869-8ada-4ed7-90c9-61296afb55aa", "indicator--6f23cfc0-ffb0-47e5-a131-a991862d499a", "indicator--98b2c8b1-5dcf-450e-b86f-d390767db2eb", "indicator--cc48388e-6618-4524-b2cc-3dbf3c119697", "indicator--d9da6142-4026-43a3-b08a-a12e8f47a67d", "indicator--243b7000-13eb-4f86-b4e2-f24f0373e79b", "indicator--26870fac-2288-483f-8792-9f768cd37b4f", "indicator--be6373bc-3a4c-4e08-b292-75ebf32d284e", "indicator--f5c91140-d8c8-4a54-a3f1-c5867579e255", "indicator--2006e41f-fb03-4bca-9d85-174d4719db85", "indicator--645d34e1-8972-47d1-8850-379a93450f2e", "indicator--b853514d-9c5d-428c-bd8c-5de43e67760c", "indicator--667a423d-1fb7-46ac-9166-16ba893d57e5", "indicator--25daf764-4a3b-45b8-99c2-116e5fe6d903", "indicator--d1f809da-9d84-4952-b5c8-690a3f8afd8d", "indicator--2819afb7-32f6-4afe-8d86-9f0da59deb78", "indicator--792fa512-e518-4ba5-9ef8-d96b9fa0dddd", "indicator--8c0330d8-a94f-4f2c-84be-facaad36fba3", "indicator--cd218259-9d9f-45c6-89e4-9d3a20b5b3a4", "indicator--cef4857f-6dd6-4182-bfde-fa9c3982c0f4", "indicator--d6c84305-abf9-4def-a90f-73b025baf6a5", "indicator--c5ada025-baa9-4ea1-9b91-c947a7305824", "indicator--1cb78daa-e90b-4776-b652-40b9be9c4f77", "indicator--b3947a62-e636-4b82-93ec-d8e07fb1a254", "indicator--84025ce0-c374-4b5b-ac5f-89ab31eafd7a", "indicator--1d2a7a58-6ba8-4a6d-aa7e-0bb501d2f32d", "indicator--d992c24b-2563-4be0-87cd-eff7fc69d31f", "indicator--cfdc81d3-6fcf-4368-862b-1bd0b8eb14e4", "indicator--71e12c70-00d6-4d87-a5a0-e2d222fe7236", "indicator--24082059-9bac-44e8-b1d4-16b5be74d46f", "indicator--bdcc27b1-cf60-48ae-8cc0-1d747d7b6012", "indicator--363b6c33-01ca-48a5-aab9-9a5d5340a9ec", "indicator--693ce958-363d-4e84-a399-03fedde040da", "indicator--e4f8aa52-65e2-48d3-a407-d661ee578c27", "indicator--236ae221-a91e-4bf3-b803-0831b8e6fed6", "indicator--574972b6-013d-453f-baed-29142e23ea45", "indicator--7498ee8c-5da3-4db6-82d1-5f5c4c253e7e", "indicator--e3d7f4c5-679b-4595-a7d8-d89fcb2bbd69", "indicator--2feb2e27-9e93-4c00-98fa-3b2ee3be13ff", "indicator--411279df-f41d-418f-bca4-799f415232b7", "indicator--71306c6f-db05-4a33-8144-957cff36e56e", "indicator--9718182d-42d0-4a01-93fd-d6f22c348404", "indicator--40fa2ddf-fe2e-4a04-a775-3bd0b9b6863f", "indicator--471af2b4-bb78-4823-87f4-4127daf1267b", "indicator--edbb4e46-4d22-4b58-9b8a-ca50d6569b3b", "indicator--eeec4377-9dab-46e5-a502-233b3a2924f0", "indicator--077be6b9-8d85-4e50-a186-65e7c4461a9b", "indicator--9d1ace08-4db5-424f-a1ce-fd4e1d210e62", "indicator--c1192dad-2e35-4922-8b70-1a4f7de4735d", "indicator--98479907-6a0c-4dee-85ce-d4490b0fff0c", "indicator--09acbe51-a1f6-433b-a728-28cf94dc0890", "indicator--56a7a3db-2ba9-4ce4-8e9d-ae7233ef69c5", "indicator--b16524a4-8ac6-44af-a109-e24aecaeea32", "indicator--cf041f4c-33ff-49ca-9337-b11c4738d4d9", "indicator--5c4d83cb-96af-46ea-9eed-50e822f34504", "indicator--12bc243f-9447-46aa-aaaf-cafdf792eb66", "indicator--7fdab045-c2f4-4e63-9432-fd71df251264", "indicator--b535c978-8b2a-4857-93f7-6b958d5caa2a", "indicator--5b4ca797-0957-4f07-9111-8d1c03b18bac", "indicator--d88e9c9b-6e25-4b53-8a7a-201f8985624c", "indicator--944bdcf1-7da5-41d3-8d1e-bdcaaedf8f5d", "indicator--06938be0-44e3-4699-91cd-4c196dacfaba", "indicator--39ffa5b0-becb-4ff9-a74c-b05eecada115", "indicator--f161b093-bdde-400b-9bbd-e31b962f2cf3", "indicator--e663754f-7031-412e-8679-e4a3f68e1f2b", "indicator--e7fcf235-2e55-4f8f-a379-df17f11908ae", "indicator--3692538d-dd05-4595-9222-35249783f6a4", "indicator--930964f7-d557-4dd2-874d-f0bac8228f55", "indicator--35d8714d-bdfb-4623-8168-bc6f23033c45", "indicator--2b29d08f-eeb8-4756-bfb9-2d85e631d6c0", "indicator--1854f26c-aea4-4a6a-b555-91d6e7f5a461", "indicator--a952d4a3-0df8-4c98-aa68-ac618d899c4f", "indicator--5d06c3b9-e186-41e4-9ffb-6229e936e2a3", "indicator--104be677-245c-49f8-b014-bde6602d985a", "indicator--9d35aca1-de11-44d6-8f0a-89d9efbc4a55", "indicator--000d892e-823d-4580-a043-4b0c5a73ba91", "indicator--4f88c368-387f-4112-808d-a72b40fd7d25", "indicator--053244cb-8f65-4905-80c5-19dd0ffcaa61", "indicator--987e884a-fb10-4aa5-8e63-217c4c684d59", "indicator--d87af863-0b68-4631-9064-c9ad141dab44", "indicator--049cd65b-d3db-42cb-ab95-76dc7f8a7f64", "indicator--5d18f391-c17f-48fe-b51c-799e591da2d7", "indicator--7cbbcafb-aa43-4e6a-9753-4110575ba2c2", "indicator--df1c88b9-67c9-496a-9a0a-4339e59b45fc", "indicator--6f1bdf3c-3746-4ea0-ac2e-4459d16f93c2", "indicator--ed8e79f0-2f0e-436b-b08a-ec839a793b9c", "indicator--ebab6fe9-6b81-4bfa-b7ba-2a621958dadd", "indicator--6c96fe6e-7547-436b-8bec-49013a599825", "indicator--aec8927d-572d-423a-a745-c45377e3c6df", "indicator--3b00d0a3-a306-499e-89fe-57a9bce71617", "indicator--cddcf2c3-a90f-4cdc-9573-4f9af13975b3", "indicator--0b2acd39-4d7b-495c-b747-a403c0c32c1f", "indicator--3018e942-1a69-4749-9ad2-9fcf98af25e6", "indicator--324cefea-e4e7-400a-a8ca-0ab9f2306642", "indicator--d456b324-4fd1-46ea-83cb-2a1432cc01c1", "indicator--00d36239-a733-485d-9951-4f4700d160b3", "indicator--fa2cb0a7-6956-4737-9b78-26a8ad9a16ea", "indicator--264ec3f5-6df0-40cd-b4a9-f2d70fb25e3f", "indicator--87bf3c76-3923-4ef0-8935-b0bbc6f6c90f", "indicator--91265fc8-6a6a-4321-bd17-5f54829bca59", "indicator--7b71f50e-c50b-4206-99b2-5d6b141b8153", "indicator--db0f9d2c-4bf3-47e6-913b-47efd1c1fe58", "indicator--c6f934aa-020c-46f1-9ffd-0651286d466f", "indicator--3c43bb97-1207-40c3-8f93-de88728c8604", "indicator--598fbff8-db5e-481e-9b1e-9ccc36ab361c", "indicator--d7d14c43-3e5d-47bc-af4d-3060a3eac03e", "indicator--70419bf2-b22a-4353-b02b-3aa48d547e7e", "indicator--9054a522-ab7e-431b-a37f-f9c72a343e8a", "indicator--5bc389f6-30c7-4f9f-bbd7-3e7cb782e7ba", "indicator--254b0489-2e62-4174-b4e6-a6aedbe91420", "indicator--56dd3e97-d927-461e-83bb-e807959bec97", "indicator--8c9c1057-0138-4c75-9494-127fc4a3d723", "indicator--f7482833-b049-4a79-aa28-a2ae27a34107", "indicator--b07a0740-06b6-4bcb-a39e-bfbedc06abd0", "indicator--52c18832-2581-4038-ad58-40d98b7b5935", "indicator--04bf047d-c13a-46dc-b579-eee24adea747", "indicator--491154da-afee-46c6-bc5a-10b0901eca80", "indicator--77dfa48b-9d82-4d1e-a7b4-d10252d4de03", "indicator--ae3b0f86-8d6c-488b-8c11-64debec55862", "indicator--cec4d2a9-4e1e-4f66-b280-c292091af6dc", "indicator--d826f196-0a15-4776-8482-d97d4991f2fb", "indicator--2708807c-507d-4445-95f3-274f852857cd", "indicator--8def1e6b-bb90-42a7-95ab-3b07b9cb1292", "indicator--297250da-2e6b-44d3-8af1-39bca1f679d5", "indicator--28ee5452-af42-4e67-96df-deeb30990ae9", "indicator--869de84d-dd73-4168-aef2-47045997aacd", "indicator--542e363c-35e6-4697-826e-8cbaa6eb2f06", "indicator--0392e6c7-2dd7-4120-a21b-343ea2462bec", "indicator--b43a7d0d-1688-4025-abbc-3e49f6b2ca79", "indicator--c9e25f94-ed5f-495f-a609-404e03c6bbcb", "indicator--aa917b67-a083-4c50-b49d-e208cb902b57", "indicator--6cd433c9-64a1-4348-bd13-b34ebf5f9463", "indicator--85342b5c-b3a1-4f29-b42b-552f0afe66bf", "indicator--c9e61f1b-eaed-41a9-8ae4-57a4dd6371cc", "indicator--784ecc3c-b87e-4ca1-87cd-bef713e0b10d", "indicator--fe1f5d30-8d22-445b-912f-cd6bfdd0b27f", "indicator--28e2720a-a808-4fb2-91ba-ed6ec003da5b", "indicator--e90e088c-db61-451d-a07e-47adbb1fbead", "indicator--e597bf7c-e376-43e9-9a95-1a0d497fe9bb", "indicator--d1e70536-a0b3-4863-95f7-4cd316832e06", "indicator--f8665aa0-ecdd-44dd-aadc-728dc03061d1", "indicator--de9de22b-6ef6-4c40-b2aa-11f28bcd0662", "indicator--e9dde52c-666d-4e7c-b0fa-f05dc2befdd7", "indicator--0a5a7b2d-4d25-4ce1-bf0d-dca0dcc22609", "indicator--46c56d77-78cf-4a54-b8ac-628e3648b962", "indicator--5b165618-e496-4b30-beaa-f7237d3b2fee", "indicator--bce02543-0e72-4634-9ccf-4e03b30ba533", "indicator--b6abf641-09e8-40ce-a9d7-15baa1b6b2d7", "indicator--9a49d5d7-bf70-4272-b0e1-848c5e7325c0", "indicator--fe983510-2165-4a5b-9dbb-5bbdbd36648c", "indicator--4d132e2f-6fb3-41d1-b41c-c6af747be4e6", "indicator--cf8c1c89-7d0d-4181-8649-554982471290", "indicator--2de2ca85-96e2-4170-af20-5713a6d8ecb9", "indicator--34c3540a-29ad-404e-a3d6-8adf01361185", "indicator--9d8c80a8-56e8-4a92-865a-82450b854f3a", "indicator--72bd0ba1-d3e9-4876-9a74-5dd967d63688", "indicator--0a77f789-143d-43af-ace8-b0559c9cb7f9", "indicator--2c21ebf1-50a6-4484-8bc6-8ded87d19d29", "indicator--9fe90b2f-0002-4d25-97fd-13e6b99ea9ed", "indicator--b4ecaf4f-bf91-4519-98a1-ad2aee25e6a6", "indicator--28e685f3-26b3-4874-ac70-b8af08708b77", "indicator--7574113b-7c93-44aa-bdcc-7d0178c7493c", "indicator--a58c1c92-b4f5-43d6-90df-2dc9d5ae583e", "indicator--802c0015-288f-4d5a-9549-3d82e61e728e", "indicator--60c92eaf-9dd4-4970-93d8-0fdd1609233e", "indicator--22b36fc1-0fa3-422b-84e4-d1d89cb7e1e5", "indicator--29c85f69-ca0b-416a-888e-fb66bac5fd1a", "indicator--0ef58200-e071-477d-9a8e-9d2bdf52e10e", "indicator--36ab2a58-05c9-49cd-a074-cec6a5f1df9e", "indicator--8d7dbcbb-765e-40aa-aeea-503b62f73112", "indicator--04aae96d-d666-485e-8b28-31ad6e0733be", "indicator--de72d201-ea93-4d5d-acb6-6a69baed479c", "indicator--d841ea0d-657a-4e27-9757-5b1704569cd4", "indicator--f50d359f-83dc-445f-9fd2-0edd97980070", "indicator--e41701df-655b-4b81-8a4b-e93c78a00e5e", "indicator--905afd27-207f-46ec-81aa-36208e7a9e98", "indicator--e385b0ef-8c38-4c8e-826f-2de07fad8fd3", "indicator--058cde9d-502c-4747-bbb2-e5cd820c297d", "indicator--3b71084c-920c-4600-8dac-7eca755ae306", "indicator--ae6fdb92-e28f-4d23-b511-691debc2d80a", "indicator--62efa92f-e49f-4c3e-9536-7c45b6f1a853", "indicator--64d386ab-724a-4af1-af81-b42bd1c8ff02", "indicator--08dbe869-5d95-4f5b-9153-0d67d23c287c", "indicator--6083da68-df39-45d6-99cc-c59f1aeea9c6", "indicator--24146757-76fe-42d6-82bc-dd963367e76c", "indicator--6b376de2-825e-43df-a2fd-76c45b1b3249", "indicator--417271fa-f9db-4e75-91eb-d8973e2ce801", "indicator--74121b4a-6672-4891-a14f-97e3a1491821", "indicator--5f68dd34-e845-48ae-a392-9dc00a10ec35", "indicator--52cb4fdc-e138-49b1-9f16-c391a2f387c0", "indicator--cbf2a80e-ca74-41af-8479-caf17f9546e9", "indicator--3db38c7b-0033-4616-9fce-5e7d24772eb5", "indicator--cdaa2c13-b836-4d67-ba2e-b441541d2d37", "indicator--509c7872-cd6a-4e04-b52f-735250178fb3", "indicator--4cb484c0-999b-446a-aa1c-c3250dac52bc", "indicator--e08811b3-e54d-4756-a627-fdd86245cacd", "indicator--afe1e4bd-f7cd-4879-89eb-ad240e07088f", "indicator--4d0f492b-aaa8-4365-b682-324e3826ca37", "indicator--a43bb2e2-f4fb-4bfd-b7bd-dd96497a6500", "indicator--5a8baec1-9b54-4dec-afa2-4fc7061a4b1f", "indicator--b358d133-4989-4355-bdcf-3208cdecbd37", "indicator--bfa5ae2e-8c46-4cd7-bc9d-d497915af74b", "indicator--325d0ae0-f05c-4944-b419-2256a5bf92db", "indicator--9b1813c0-18b2-443c-877a-25638553acaf", "indicator--ddb897c0-2ea7-4731-9855-a89b9cc65fdb", "indicator--c8629d6b-502f-4066-8cd0-bde0bdc8aeed", "indicator--4531dbbe-a1f4-4d92-b4a6-180f1e26670b", "indicator--f02bb182-eb0e-4ca8-863c-4b219c2a4f24", "indicator--e37cfe2f-cc6d-49c9-83ff-66c1e16d119b", "indicator--a8b6f6db-a7d8-4b99-b1ec-f8f6cfd7b223", "indicator--c0620455-e0dd-4d02-bce9-bdde180f207e", "indicator--7336ca45-180c-4f59-ac1e-f73561b5b354", "indicator--fc418b9a-19ec-4591-ba0b-da6a0d8b1069", "indicator--2b0415ec-d16d-43e3-bc4f-07ea89dfe3c3", "indicator--7a2dfb2c-45d9-49cd-88a8-c59873fd728a", "indicator--7039d388-bf0e-403f-86ff-97beb83e8923", "indicator--318a4828-4b9b-4c52-94a7-0c1a4d3932e8", "indicator--c5cedc92-a546-4e54-aca0-45997bde7d8b", "indicator--896db334-c63e-4c51-83c4-f0cd9804c6b0", "indicator--28dc69b6-53f9-4782-9cd5-224f194582ef", "indicator--f69cb840-054f-417c-961d-3496234f5c47", "indicator--5be04780-4484-4063-b1fa-882631822b45", "indicator--5428c2fe-46e8-4f65-8aa9-1059aef1ae8e", "indicator--76342c9a-abb0-4363-961d-2adeedbeaf94", "indicator--75f39c96-e672-4d00-87d4-dc472c83e2c9", "indicator--ea0ee0d8-274e-4667-a2ec-cd72344bebfb", "indicator--73b2eae9-d493-4abe-949b-0fd75df7fff1", "indicator--b6417d77-49b2-4831-9cf9-cf066f359397", "indicator--f0ecf97c-5949-4e44-8ed0-baeb877ce199", "indicator--33b5c9bd-54ad-4e86-baa9-852a09abc059", "indicator--c278d53d-8976-459a-bc41-4bc08507a241", "indicator--c33405a6-029c-411b-980e-6eb84a1470bb", "indicator--83fb1d87-3cea-44be-bc3c-f6cbec94ee76", "indicator--adda69fd-8b27-4dfe-b2ef-869bf1878819", "indicator--3ca5deaf-d503-4394-b1f6-f8a78e8cce90", "indicator--01450f74-ab8c-4204-9977-8b75ec8e0c1c", "indicator--fde18f09-c695-4f62-9a3c-0d939e4d7636", "indicator--4021a573-5aa3-448e-b989-7f7646fa2fb5", "indicator--877fbd0d-bd1f-486c-b6c9-876b2ea8aa85", "indicator--205cc611-369d-47d8-8918-8af6e768602e", "indicator--ff809ef0-4550-4bfe-942f-c03c5504f04b", "indicator--cb831460-ac6a-4fbc-8bb1-44b96a563e69", "indicator--30775f11-3a52-4deb-adeb-15dc75bd5541", "indicator--9dbb77e9-41a8-4109-bf35-cb1e19e42484", "indicator--fbb7eb2b-f755-41be-9605-bd330941d916", "indicator--e40b3f3e-8d46-4836-8b32-f34db806efdf", "indicator--ffb0cb96-e38b-40a5-a2db-9bef414376bf", "indicator--d8c8ce7f-51f2-4708-b517-fee7a317cdf2", "indicator--cbb8b734-d3c2-487e-8910-d2f50077cb23", "indicator--e690136e-a2c2-4633-81d6-d2b37c31fab3", "indicator--bdf73193-b260-4891-89a5-ea5610a25d0f", "indicator--b757ce8e-88a0-4c25-a703-c1350d4c1f40", "indicator--e43e3904-ccdd-48db-b7a8-511099db7a76", "indicator--1206bad3-ad6d-4d43-b4ab-3cbefd5f3fbf", "indicator--91357f1e-5f13-4601-b7a4-05fe4ba66792", "indicator--b939fc79-de5c-4051-ac98-db5289352f93", "indicator--7f1eb3fe-bacd-4dbb-9940-0be85231145f", "indicator--7d581b25-e098-49f4-9e37-bb893dcb7353", "indicator--6f0150a7-d763-4e15-81aa-e13b7b7bcd3a", "indicator--f742af2b-a51f-40f8-ac53-d7b9e0768095", "indicator--f8358178-8e44-47c9-97eb-5ef1f086390f", "indicator--3486aab5-85e1-4c4c-941a-fa99f0add7c1", "indicator--04ebbee7-c6c4-44da-9e54-6b2241fdaa2a", "indicator--d0be8d5c-3ae1-4f9a-8bdb-a742b3d96c0a", "indicator--310ee24a-4abd-457d-a6ae-1a04431d2216", "indicator--05f6d2f6-97d3-44a6-8fae-3028905034ea", "indicator--bc365034-03bd-4d21-b932-591847b4da36", "indicator--6f3f06db-9876-4f46-922e-bdbee403c1d4", "indicator--68b7ca03-3764-42ce-a81e-cc5404377680", "indicator--df3174bf-bb06-4a24-a4d0-d5b2fe8935ef", "indicator--560b1e4d-36f0-43ca-b33c-0519ac9191ca", "indicator--f7c98765-def8-4b64-bffe-4e32af539566", "indicator--1dd5fb71-27c1-428f-ad1e-05daff87713f", "indicator--e56d2b77-6fef-40a9-872b-7a90cff3996e", "indicator--8a8307b8-20c1-4928-b650-bb04ac64590b", "indicator--bed6c265-8cae-4095-ba0c-fc3d182df566", "indicator--6d3eb648-c1c4-4d14-8c77-ca43fa76d4e5", "indicator--0a5a8003-cd70-4deb-93d0-a8d7b403304f", "indicator--5b242112-b156-433d-9797-828814ddf1a4", "indicator--3bc7b43b-d410-48e1-95a6-d9351ce13288", "indicator--b0668ce6-21cc-452a-bd39-d01360d6818f", "indicator--c151e851-599b-4223-8ab3-c05db72e38ca", "indicator--2aaba814-87a6-4b0a-970d-c8640d4a1431", "indicator--74523c57-8971-4003-8a52-173fc3bc239a", "indicator--126a5fcc-ac80-4f42-9dc3-c09b6ba924c8", "indicator--f336d5e9-4b01-4d5d-a8fa-9e474b7694b1", "indicator--648a6644-a8f2-4c67-bb79-494898fb3100", "indicator--22c3600c-1b79-499c-8cbd-e29eabc8cab0", "indicator--3763d8e5-e14e-4597-90f4-5fe28b0d592a", "indicator--02a4ff26-d0dc-43ab-87a2-2a122f7d1869", "indicator--73cb9883-a083-4ec5-95e2-c06c4d50becf", "indicator--a03227e3-c73a-4c56-9a77-95fc087226b1", "indicator--0a87b115-5395-4ddd-8b71-9d8bec911121", "indicator--57a52ecc-415f-4e07-822e-bdb56c35e70c", "indicator--2eafa694-b812-4ad5-88da-b1010d6c42b7", "indicator--c7b27098-5ba8-410c-b6dc-b0f015e197e1", "indicator--b9313974-1221-4b5f-9758-aa5dfdee1731", "indicator--c9d56243-14ab-4cf4-8f79-7e9112832709", "indicator--ad313dfd-45c3-421b-bae1-8194037246e7", "indicator--2940e930-d33d-4483-88c3-6eadd077d45a", "indicator--2ff917a5-6025-4987-8f13-412551d1cf9e", "indicator--e4f5a7ea-2582-4c43-b4bf-f30f439083cb", "indicator--d4c10015-32a5-4a50-b2f8-71cd91774481", "indicator--8471e638-3a3e-4914-bd28-6c9ebc66752a", "indicator--e7183680-ed0f-4546-bd1a-1b773914652a", "indicator--f16aa345-a2eb-4156-9756-9ad3e51d9279", "indicator--e61fbb51-59df-4436-80c2-3f79f7653b99", "indicator--94a9b28e-e519-4788-bd8b-baa248a9e2a6", "indicator--ab41a3bb-7db1-4920-a924-da6bc17c7f42", "indicator--ec7b3ff9-4fdf-4cf1-b3e5-a882dc11b269", "indicator--6d88900f-ee3e-4995-a3b4-609d1d6310ec", "indicator--4ab21da4-0662-4143-96f9-d0c4bf041858", "indicator--ae50b616-e59e-4878-8b2c-42284d851450", "indicator--33e49ab4-c2ee-4ef5-8b65-0e90faf68373", "indicator--2fcd80a1-2703-4d4e-ad97-a0ba552b8b95", "indicator--5a8e456f-8515-4dbb-8d7e-f74efb4676ec", "indicator--231fffc2-4c91-4800-9bbc-39888194ba1e", "indicator--72a8ed35-b8ab-4ab3-9260-10d135287c2a", "indicator--c87fa53d-983e-4933-b4b3-7168857f8608", "indicator--4e94380a-f678-4fbc-a3a4-741e52df8e49", "indicator--2dbbd57c-3fe2-40ca-a0da-6b5c9335d43d", "indicator--07662084-6300-423c-9eab-f25d897f22dd", "indicator--7f7e1294-8ef7-45e8-b462-0060af1808c3", "indicator--ee5acf0b-074b-44f6-802b-a3df7d74b68e", "indicator--8cfef5bd-dcdb-40a8-896f-60425c2e060e", "indicator--c77d8173-efba-49bc-a94c-a681a9358a62", "indicator--77c9791b-a0c0-4759-b075-562f3ac5b9b7", "indicator--40a7c778-9e06-428f-9a2d-695793d02143", "indicator--6a1b98c8-d301-4182-9538-4b035f7d9678", "indicator--ade92aab-a4c8-4476-bf6d-00eaa63b7e3e", "indicator--d30d72ba-4908-4b9e-b306-879f26aab659", "indicator--bf7c47d8-855f-4bb9-bd7c-1f1cf0be36fa", "indicator--698f221d-9bcf-47e5-970d-a826a3b9b99f", "indicator--bbd98da9-03d0-4cf3-839c-c389dfdc40fe", "indicator--bd9d01bc-07bb-4278-aa19-4ac7eee6ab69", "indicator--757ef6f4-f375-474c-aaf1-ce08ce15d05d", "indicator--eaef0b84-23cf-46e5-bcc1-4a9ed7cf0007", "indicator--ce424864-229d-4a45-8b2d-5493eb9ffa67", "indicator--71f8ba40-184b-4ea2-8f70-98a126eb8770", "indicator--d4e92f63-63d2-40bc-b13d-95042d77eefd", "indicator--d6405354-6d40-4d3c-9703-ed52bb353f10", "indicator--b709ee5d-dfd4-4d1f-98c8-f1fd4ea617f9", "indicator--e80d764e-b967-46b8-b715-97cf57eb80fd", "indicator--767713e8-5375-4879-9351-a87a399aef7e", "indicator--d0c797be-de71-42fc-83ac-be69580b85e5", "indicator--336ec8c2-6637-4537-92a6-5b6176823af5", "indicator--ff80056f-1041-44b2-b1a9-ebd81e1c4b56", "indicator--7b9ff36e-7a6e-41ae-84cd-aac33dfd144e", "indicator--2131cf06-2d6e-4eb1-8a48-6b8b0914f968", "indicator--1ba1f2b1-6f30-42fb-af1d-f6288e881c65", "indicator--89f1c316-f0e4-451a-a641-4cf4e42f113b", "indicator--9badcf2a-0280-4788-84b3-c532d2997b6f", "indicator--1c98995e-c34b-4d53-8b67-f5eae900751b", "indicator--fc9a05f2-65f3-4c4f-8389-ebc6ea0aa214", "indicator--78cbf6e2-f7d7-4481-8883-fe7da6aae879", "indicator--df63f92a-2df2-4150-a8ea-fedfa5a06745", "indicator--f2421e96-a9b4-40a5-a4d1-625dfb616b7a", "indicator--c598e885-f160-44b0-8526-9acd2efaf818", "indicator--260d50ae-4e6d-494e-920f-5a88b79ed864", "indicator--aa29540a-10da-43e4-9348-7bb283be332c", "indicator--a10a87e6-0614-4768-aff8-aa2f9128a1e4", "indicator--2d3d0e2f-76d4-45a5-8cc5-4b13f543b4ef", "indicator--92da3ffb-a8ca-4628-ab5a-9c88f003a388", "indicator--6ff3d92f-d8af-4935-89cd-6c1be6c420c8", "indicator--f7830493-6b0b-43fa-8555-74535b1cda82", "indicator--a2d1a7af-19a3-48c1-903f-c9da2797774e", "indicator--48838dc5-51cc-4993-8b26-5224979efc6f", "indicator--4c5e80a6-93ef-4025-9dc5-99c78803cb73", "indicator--9160125a-799a-486e-9339-0c7747d04be2", "indicator--c9337178-908d-4775-ba4f-e0e6b5283137", "indicator--a45b7196-b44d-4bf4-a272-692ebadbaeb2", "indicator--c6a82e45-f752-4d5e-b0a7-601d4a36ff2a", "indicator--5875b038-6ed4-42bf-a5e8-385e1cb8bf62", "indicator--a1e55590-7761-4a45-93e5-55be3f9fda2f", "indicator--593ef4ff-36cb-41a4-a3cf-add36e2a3612", "indicator--7eb506d6-dadc-4b40-b0a9-ba4c87e04ec1", "indicator--9cea2453-ccd9-4c52-901a-fad74d81dd9b", "indicator--bdc0eb85-a6dd-4396-b525-15bf432448d7", "indicator--aedc7708-04b9-459f-bea3-f0a71b648f3e", "indicator--99bf1ffb-9bea-415f-b430-c9b122ee66d3", "indicator--ab816dab-e742-424b-91fb-de38059ea43f", "indicator--cf233e54-096c-4a61-a10a-ebf7d4058b07", "indicator--a5b48159-b959-40ce-ab8a-23b47406f4d8", "indicator--2bc88b21-7065-4f9f-a09b-425a6e860a0e", "indicator--af8de379-2a61-4a48-8c53-6bcecd14be70", "indicator--c3b2b271-e06e-402c-9a61-c55c9d78b53f", "indicator--832f186f-9a32-43a7-aefd-0b5cfc6753c4", "indicator--6d58706f-12c8-45b1-9a9f-74c497699650", "indicator--f5e3d06c-1ac5-4a21-8caf-874b5cd0a9f9", "indicator--9f162a39-3239-417b-9779-5aabd5636f92", "indicator--165c35d6-bf2a-49a1-a2e2-1dc3c44ba7fd", "indicator--fd2196a3-aef3-42a8-90ae-d7489e08b20c", "indicator--9869186b-444b-4602-b9ec-f78620c016f0", "indicator--21e782d4-9482-42e6-8542-1034eba82865", "indicator--6771ef50-b40b-46c2-9308-3bce81768281", "indicator--e7f49b16-0b13-41b4-9b6f-3d18b325dead", "indicator--326e0ed2-25e6-4a50-beae-5f4e54f4f2ee", "indicator--0e7130e8-75ef-4f8c-ac69-7f91a7072605", "indicator--7d85f26a-7287-4d80-8db1-9143a1714d22", "indicator--954045b7-bde2-4dae-bae2-f44e59ae6115", "indicator--7751ccbb-90ad-40bf-b085-9cd094805cf3", "indicator--81ff4be7-9806-44b0-8fe7-7f5ea22193e6", "indicator--ccc60bbc-c2fe-4782-b332-d4eedd8a761c", "indicator--dd0f095e-a513-42d9-ba38-f2d01f92a248", "indicator--115becde-b9b6-425a-bb8d-3fb031107e66", "indicator--d37f562d-8834-4b2f-abda-c4c3145aeccb", "indicator--072d4695-432b-464b-afdc-2694377f2f66", "indicator--cd8bd821-1316-4b87-b58b-cb5750da1118", "indicator--3c371f86-be3e-4e95-8700-03ac1083ebf3", "indicator--3a8e7fad-382d-4ebf-bcc2-3e6feec411d4", "indicator--4543b2b5-6dd9-40e2-8ffe-b8911c9bf8eb", "indicator--ec4779c8-54b8-4a3d-9bbb-db46ce1bc9f3", "indicator--4ed54cd5-348d-40ce-9c71-ee50ff085714", "indicator--fa744e41-6f4a-4c1c-b2cf-c4c22fd83fc9", "indicator--a3f363bb-a5ee-4648-a633-5520f345403f", "indicator--cc363f8f-1751-40af-a1e7-2b9e4d79dc58", "indicator--6e75f81a-d030-4753-be10-3039cf7124e1", "indicator--46183d6c-6b9c-4cbf-be76-c4a96a542c39", "indicator--3d303334-eeda-4492-a079-e812452d1fb6", "indicator--1ed0e76d-4341-4d53-a1c4-1178971e9fb1", "indicator--cf902e70-3f36-400a-ad51-e2d0915e3a29", "indicator--569d87fd-4975-42dc-9ad9-bca0c6d77d60", "indicator--b2379a31-9daa-432e-ac9c-0a21ad46446b", "indicator--89e06725-920b-42ab-ab9d-59ee83acb77b", "indicator--5fb86acc-f9a0-4001-aaf3-cc25da1f4a40", "indicator--1aa45171-0540-4097-8e69-d6bb3b6fbc03", "indicator--eabe9bfa-b8fd-42dc-aa70-dbf0656065c7", "indicator--aefe76ed-68f9-4f7d-904f-993c2c103ab0", "indicator--64be87ca-dd4e-4983-a36a-32a7cf8aa459", "indicator--430b3c67-de1c-4ae1-929f-df5bb8749710", "indicator--7a3749b1-d007-41a4-ac81-09612ac12fd0", "indicator--370c6754-7df7-4cbd-a5d9-1f3ea063b0b1", "indicator--73c930cb-9c94-471b-86a7-c25d569dcdad", "indicator--c1afa71c-494a-4eee-b21e-17f3375055d7", "indicator--8d1f473b-68d0-4e5a-a52f-12e7429ec9a2", "indicator--5d4b8d91-3139-4c8e-b536-393e6aef94e5", "indicator--382586cb-87f4-4ccb-a2b0-9b1baa9d3d02", "indicator--91e2fb14-559a-45d1-bdd7-a66570728f69", "indicator--c78f8c96-a2cd-4e42-8cb9-d296ef6fd200", "indicator--2b534ece-d645-4115-86cc-4763721ff7f1", "indicator--696b8ee0-1e4f-4758-a43e-bebf0bf6e19c", "indicator--4427d953-2690-4328-8eaa-c5e9652746ea", "indicator--196c1d81-2dce-4de2-914e-c83d880e7f3d", "indicator--91213658-10d5-44d3-8404-5200d3844fb6", "indicator--ff0f9040-c528-4e3b-9d63-8e13006afd49", "indicator--f11d29ea-3804-4ec1-8f64-1ab79d50c34c", "indicator--372415e0-069e-4d6c-8cbb-e9cd1bc00746", "indicator--9a9bee84-b69f-4cd5-9948-14bc3ffd333f", "indicator--36233ba2-39ca-4d08-8157-e275764c23d9", "indicator--84d07885-0879-432d-abf3-276ac9864403", "indicator--ffd021ed-b38b-43e5-9cd3-ce3c599e58d6", "indicator--dfde6b8d-4b74-4965-8a30-dc6f7e91a2ed", "indicator--99f49193-fb6e-435b-a999-f69a90d7e28f", "indicator--5b1c343d-1f57-41dc-ad12-7ad4cf19ebda", "indicator--9d5b07f1-57c0-48d1-aaa7-0b70de68220a", "indicator--83a39c97-97d7-487b-b816-c99b83929e4d", "indicator--5734260d-e7b8-405f-86d9-13e575ff1a01", "indicator--b2130195-6e62-471b-8e94-55fbc99661bd", "indicator--1ebccfc7-191f-49c2-81a1-7fba575a04bb", "indicator--c84842ac-c213-4c3e-9689-427aac489536", "indicator--d7fc4b41-50f0-4b97-996e-735650e2859f", "indicator--28d1eca7-0b14-4a3c-a6cb-71d668146be0", "indicator--ca5412fe-db53-4f66-8267-234b8e51314f", "indicator--d25b8613-4436-4699-9442-a0b2713d35e3", "indicator--69440be9-69d4-4fe1-aee3-73310a4eeae5", "indicator--1af27a3e-8b14-4bbd-8919-098b94fb9439", "indicator--db0b4a57-d477-466a-8231-6b2b7f655805", "indicator--cbc7373c-33f2-48ae-9162-596a0260cddb", "indicator--dc033d71-1400-4020-ad28-20f4859f27a1", "indicator--2135f74c-10b2-4888-ab40-775f96de9215", "indicator--ab6ad826-2084-4096-91a0-0bcd14ae10ae", "indicator--f7959916-6dc2-4f1a-a768-d9e3c9285d60", "indicator--8131c2bc-fdfe-4405-a46d-205315ea1b89", "indicator--559528d3-092f-4973-b589-c47ecdbca595", "indicator--3d50eb55-f71d-47ff-8f7e-0a5556a58465", "indicator--6bccb7c9-a437-49fd-908a-6ba58ae724c2", "indicator--edf3bd2d-0d2d-43f2-a168-fd51a6987123", "indicator--5018ca88-5504-4c91-b624-29ad91af7edd", "indicator--ddd8ccb7-8338-45e6-a858-ff1f7725e8e1", "indicator--1d76ac84-476a-4c55-a98e-0077df5120a9", "indicator--212e2b4d-64b7-4c08-ae5f-30ed58f3a470", "indicator--c9089cec-66f0-427f-8c82-b79d44ee7eda", "indicator--9a5a344a-215d-4c74-bac1-06198fd0f909", "indicator--ae9463ad-70a8-4ff1-b82e-bdaf565ac14d", "indicator--a053fbfc-2969-4b32-8d49-6b5ee140295d", "indicator--993c0b31-7164-4281-a5c7-47438ab5c58a", "indicator--190d329c-8f15-43be-9bd2-d2e01250b6dd", "indicator--a9404219-e5b9-481d-8833-1b173ec96b20", "indicator--19570576-ed74-4775-b3d6-1ade562a6db2", "indicator--d0383a65-a23b-4f94-851a-e524e875fbc1", "indicator--ed03bedd-c204-4032-bd86-9ed91d6d0a1b", "indicator--dafcd5d8-d1cf-4aa3-9a0b-7181c7138f3e", "indicator--be92e537-b24f-4a67-9251-2c7305965419", "indicator--f7d0dcc9-d74d-4845-8099-a7b00b8d43f7", "indicator--26fa7c01-d9c7-467b-bcda-036a9ad16ecd", "indicator--87c80548-57c9-4f5b-8bd7-f30f3f163b59", "indicator--252e39f3-98fb-434c-80c6-eb7593916057", "indicator--da23bb64-f1cf-47ab-ab7a-3ba445460012", "indicator--d9254050-8035-4367-9b65-a0f408df0f42", "indicator--eca301b4-d029-4406-bebb-afe39f59c0c4", "indicator--7a58afd4-1f49-4ce9-9f5c-e668dde3bba6", "indicator--79338cfe-a473-4793-b757-40a54eb7eb4a", "indicator--93f159b8-f893-4cad-878e-09285c842376", "indicator--e8b350e3-494b-417e-935d-bf7e5ad0c45f", "indicator--bae6df6d-8920-4fb8-aa4f-a80d17f42645", "indicator--41f33c5a-55fc-427f-b47a-0bde6c5b6ab8", "indicator--276daa85-5fca-4940-85a8-d77b1698713d", "indicator--c41b3a83-d009-4b1d-8a44-8267128d3d67", "indicator--555232d8-c04a-43dd-b7b2-5fda010796ea", "indicator--b88463b6-18da-4df6-a0d4-f4910b81cc85", "indicator--ad1486f4-45e7-436a-8248-aaecd8c7d34b", "indicator--82b4d296-cb94-42e7-a128-3f82aa6f856e", "indicator--13d1b069-5a93-466a-8f8d-d7eb7af4f619", "indicator--a22c83e0-6f07-4a9c-8ea9-f7d53f4e860a", "indicator--5749fd83-0040-4129-bff7-7c9f7000e7ed", "indicator--0a39d66f-b7ca-451e-8705-61b07e7e7fd3", "indicator--6b2dbce7-8f41-4a2c-a9f3-8043d35042cb", "indicator--3b230191-37e8-41ec-828e-57af8ed212de", "indicator--111bdf0f-7aba-4a07-8445-980789478985", "indicator--67ece8fa-09b0-4335-a9d0-481381c72c09", "indicator--c57a0496-1f94-42c5-bb1e-d1c8b29baf0c", "indicator--84bb5e01-314b-4585-8a7a-944841b52615", "indicator--61652223-7a6f-49fd-ac93-212610522fe7", "indicator--f003a67a-0e3c-41b9-bae8-1b47e7fe4d46", "indicator--84c092c2-b901-4abd-9145-a759516b1524", "indicator--dfcc49ce-28bb-4e2e-80c7-fe7d5926d996", "indicator--4374f0ba-d9ca-42fd-a28d-21eb54573817", "indicator--e3e88b27-5d99-438a-b565-13c09e8ba257", "indicator--15f04675-4f74-4c92-a2da-92349390711c", "indicator--c3bbc729-6b33-425c-b68f-e37239cdbcee", "indicator--f2b0f528-41f1-4a7a-aa0b-de6e693472cc", "indicator--41157a92-0b2e-4f01-bb4b-78d302a83d14", "indicator--22473382-8770-4425-989d-3b7468a64410", "indicator--73518d88-2467-4c8c-af58-e8e4b44cec7e", "indicator--cba2d799-285f-4cba-9d62-bf8248dbcff1", "indicator--01ed4fe7-ab0d-4410-9cc5-3de6738cab36", "indicator--cfd99216-eb64-4654-964f-75efa84d1844", "indicator--ff598894-2553-4278-91c3-7db9a4e34dcb", "indicator--5808ab5f-444b-4404-a05e-3b902412bb82", "indicator--61eecf2f-874b-4f15-89f3-802bdb3ba9cf", "indicator--7ebd54a8-b628-442b-87dc-7c3e42c8d634", "indicator--93b3de0b-ef95-4b27-97ee-2fa884f26ddb", "indicator--b45e740c-7430-4b8f-9c11-0301085213a9", "indicator--0713ad38-07b1-42b5-b62a-8c2077ef5424", "indicator--b55ec76c-ca62-46df-bb3c-16c14c723950", "indicator--7fac037b-4fe9-4aab-a9da-32e30b8c9eb3", "indicator--eafb69cd-720f-44ec-8be7-cad2b72ebcd6", "indicator--43f5b0ea-f189-408e-b42d-2630ba49e987", "indicator--455339c7-eaae-4eaf-beb4-70138ac9dbd2", "indicator--e7937e7f-3f54-4c1b-b11f-dd727638d542", "indicator--da66cdb7-1252-4343-8f28-89d68900fe77", "indicator--3ea14ae4-51f1-4f1c-aad0-65c75a6f9dd6", "indicator--cc406e27-e26d-4cff-ae6e-c75610c27df3", "indicator--5e01a99e-4812-4ab9-b4f1-91d20c8a09d9", "indicator--3c7b4adc-8cf1-49ab-b454-6eab7c339331", "indicator--9345b21c-79ed-4cb1-b158-dc4f5cf45e7f", "indicator--e603d165-a893-4c94-82f1-1260806be7d1", "indicator--e741f154-e00a-4a0c-9861-16f2b0c1593f", "indicator--8e4936e2-4800-4805-bfad-83020bc3d9c2", "indicator--af4da165-1935-4545-8086-edc177fe8379", "indicator--c8a6e988-e845-40ce-a439-60f1aa870442", "indicator--2a9c127d-b956-4885-acc9-4b1362a8675f", "indicator--8f24fd8e-08fa-40c8-a11f-51112ee5598b", "indicator--cf960c85-caa6-404b-94d9-9a9568428608", "indicator--962276d0-c60c-4293-a80e-079361a94c3b", "indicator--dec9af2e-9f86-46f8-8434-302488287a94", "indicator--80ff6c08-d3f7-49fa-b477-47e05bb22e84", "indicator--7beb0a25-7426-49c1-9efd-c3411aa60c46", "indicator--0e725ebc-80e5-4a41-8512-3a17e21d6cf3", "indicator--07c915dd-5cd0-41d2-bf0a-889ee1754a7c", "indicator--23257de8-d4f9-490c-8544-5fdc521ea86a", "indicator--ebf920e4-1c11-4cd1-b0f1-37e1e610ad22", "indicator--a5f45cd2-f12f-4f99-8db8-c8fd8cf10e9d", "indicator--1be7f1c2-017c-4b34-9769-5402446996c2", "indicator--a5884c39-40d2-4109-9d04-8f022f209c3a", "indicator--de209ea9-983f-4562-9c3b-6629a06e4a11", "indicator--b590546c-4d75-4cb8-9994-6b321bc0f841", "indicator--33fd94d9-25a8-4537-8c51-852f836e2ce8", "indicator--f8500db1-0271-4ad0-a366-48b0965bb7e5", "indicator--7df563a1-dd19-4d52-8658-5017aeff376e", "indicator--283c9a9d-397b-4d1b-9b19-21841b65d903", "indicator--16686b31-e8bb-42b9-be41-53d9676b7e0c", "indicator--b53544a2-55ca-4954-af20-17eaf1c472ce", "indicator--2a038407-abb0-4671-a17f-185e1013b32d", "indicator--6ae83d0e-3bf7-4e7a-a626-279ef55cb37a", "indicator--99b856c3-5b78-4efb-a9d6-0d19771e94b8", "indicator--76b456c5-2056-4ace-83c0-5c801dc5c661", "indicator--d7e785b9-78c8-46ce-83ec-0d4f9f34bfc9", "indicator--8a1c6016-8e75-4f2d-9d86-a50a4b7d1982", "indicator--4aad9ba9-adfe-41f5-8862-c467cd9b8b69", "indicator--8bd31e5d-8e32-4426-8aff-445fd0931f71", "indicator--09e6c93e-2ea8-4393-a585-e2cc8c89fe1e", "indicator--98d8701d-0720-4490-98aa-cd1da906f0d7", "indicator--ff79b53b-3d3b-4c01-9d1a-49e67ab005a1", "indicator--c69522d5-5365-4836-8e98-7eabeb76b7d6", "indicator--1732fe29-c78e-41b7-b61a-47fc3ec65759", "indicator--e06d9cd2-67bd-4243-824d-040e66ec4ae8", "indicator--f43e8ded-a5e4-476f-9837-59cfb7477e52", "indicator--73363de4-a4b2-4fc7-bb23-7c33250297ff", "indicator--8568442f-bfdd-4491-b884-78f676987530", "indicator--7ed05baf-af72-40c9-8120-4140be035a28", "indicator--bb96aae6-b2e1-45c1-8d5f-c029e284448a", "indicator--603a49d7-2067-44a5-a816-b9350987bf39", "indicator--0c26705d-d3fe-4c13-a1cd-4c077d5b2de8", "indicator--22155cb7-45f7-464e-b254-9dd6795ef963", "indicator--82c22417-231a-4de5-9ea8-fb3d12241b96", "indicator--7b06edbe-12c0-4707-a01d-ac27691dfb95", "indicator--c3d0fd4b-927b-4d1a-916b-cd324d03c52b", "indicator--9cf47fba-b8e3-477f-8bcc-9a4529ba9bae", "indicator--f8bd7783-22de-4f74-8922-00e709378c7c", "indicator--4bacfbcb-5a76-4468-8900-7d94a5e855e0", "indicator--1ee35cb1-0694-4281-8b8e-1d8a60c65b63", "indicator--7f7a4f25-2d9f-4624-85a0-f95789abff47", "indicator--c046ab39-3e2d-4700-a609-2aea81ff5e07", "indicator--a98af2b7-91ba-4682-9974-c97391c9869e", "indicator--8415e9a2-1068-48e2-9e8d-3c4c8620f23a", "indicator--493ed34b-2875-4b85-8f3f-4638b5946321", "indicator--22f67053-fa28-4f75-a3fa-6fbb02c61acf", "indicator--1e798526-776b-4ef3-a5b4-44da2ee32ae8", "indicator--d22e6f11-fb9d-4fe7-8af6-2578d3780d5e", "indicator--2e3e8106-0d06-4685-98d3-9ff40a27dcda", "indicator--80a29a66-94f4-4a94-bf59-81b45f0a877c", "indicator--f9e15abe-3ca1-4e84-abd2-fc49e7b069cd", "indicator--7a4094ce-f976-41e1-9804-7c148b40d0fb", "indicator--e633446f-f3ec-42dd-bed4-e74e3e2b973b", "indicator--98d518aa-ad63-40d5-82c6-fee5f1c402d6", "indicator--a06164a8-4cf8-4859-a787-d08685883996", "indicator--1b2848b8-2109-4090-8ad4-14c9cedd6566", "indicator--59a8f481-ea00-4ad4-802c-fdf507a0bd53", "indicator--24327486-3467-424e-8e5a-2161c629f355", "indicator--b028f50d-c43f-48bf-a98d-281877ccd034", "indicator--56c114df-ad4f-40cb-8c4c-7b99d746b460", "indicator--a9f8c9e7-e73a-4dfc-9c1a-7badef5e1776", "indicator--19cadae5-d175-4c3b-8f37-4a69e05b6069", "indicator--a8825ad9-644f-4d5b-bb12-2056d21335a9", "indicator--c60b805a-3521-4498-9b76-8ef6d7f12a66", "indicator--5b51bba8-fc98-4342-ae91-af32d0209e7a", "indicator--94025145-e0ac-4a2d-a3a5-1d3cd616e74b", "indicator--66edf3f1-9995-42d7-8191-700b53f3a4a5", "indicator--21bd588f-58a8-4327-9a47-511f4b158f30", "indicator--3eddfb00-14cc-45ee-ae0c-76f0198d4a50", "indicator--a4a2e4e0-45e2-4445-bdd2-7a88914b14d9", "indicator--c62ef264-56d1-4fdc-bd41-3bd3dafe326a", "indicator--8b1bdec3-8941-4098-9478-8100c93e3183", "indicator--20c6e1e4-41a6-45a7-b015-102536a97eb2", "indicator--ae4d4217-76d9-4099-9669-7ee515103a08", "indicator--f9045a17-cb22-45d2-888b-70477accec69", "indicator--61a85514-f298-4f79-a710-365bdb60c066", "indicator--8ff319c9-808a-4bb7-8ce9-aadf695ed80c", "indicator--53cdb68e-0ff6-4faf-a329-8a5b4936f003", "indicator--8565fe24-c941-4daa-9b37-b064bb1c895b", "indicator--d3843685-56cd-4a30-a92d-071cdfa9126a", "indicator--d26adbe0-dba4-41d1-89e4-76ab26a3cf38", "indicator--7a56571d-8119-498e-b565-f6944300f2e9", "indicator--e714ca39-6953-47f7-a0c9-1d12b4d44f49", "indicator--9bc5b6cf-256a-4890-82f7-fb1558a26dc5", "indicator--0eb8a59b-5d8d-4723-87ee-558adcd2c39f", "indicator--faa9d69c-9192-4d35-9a30-35fa8326afd0", "indicator--8c59c27f-78f7-48ae-8229-0bfb4a702696", "indicator--3aa6a841-e27d-4d2b-99e2-ba6a1c8f1892", "indicator--542073f1-d875-478a-adc4-e82d8324fdd9", "indicator--0b08d9e3-d724-4864-91e3-2e07d3b5afb6", "indicator--0a580e1f-54e4-421b-b4f0-9b55d15ab307", "indicator--3cd726da-2e23-4d21-b248-89c071a7a435", "indicator--4e077a3f-ffd6-4d49-a09a-3996af640599", "indicator--e7a34284-2a2f-4a81-ba3e-87f870c290cd", "indicator--b08e1f3a-6416-4d8c-a7ce-e52f75787938", "indicator--5aa22dad-dc1b-4101-b673-0093be2282b4", "indicator--9091101d-c3cd-43ed-93ed-65e2a6688af7", "indicator--44824c2b-3578-469a-a0a0-911600384d1e", "indicator--d635fa2e-181e-4ad7-8df4-4ce8016d8a72", "indicator--eb5bd649-da82-4bb3-85ca-32d06a12eeaa", "indicator--daec7517-01ec-4da8-99a3-2742a5b8c866", "indicator--dde288f5-d9e9-4957-8afa-5ebe9b5c2c31", "indicator--01eba3ab-2f1c-4764-9bf3-f1bff2fe8264", "indicator--bec18229-955e-4dba-9d9e-c0eaa68557df", "indicator--e5dc45cf-63a8-447e-abd0-c715b1730a75", "indicator--cb8d0a8b-0b4f-4d53-8c84-e42b026abc9f", "indicator--29e8717f-18eb-40db-beef-f335f117411b", "indicator--d04a0302-9570-4d79-a093-de34ce40a36d", "indicator--1d6c47e4-4b0f-4fcf-a76b-4b82d7403cda", "indicator--ad513f83-8294-4892-ba7f-06f16c190cf3", "indicator--9e76c414-000a-40de-a713-5fe284a91c75", "indicator--513ace1a-2fb5-43e5-aee1-2f19979379a7", "indicator--62d75468-92b4-434e-bf7a-3411fdd22037", "indicator--a70a85a8-61c8-4b62-a71a-24a0c842cff9", "indicator--74e5f7fb-3f20-419d-9698-07983dfac757", "indicator--31d109e8-68b4-4b24-9a6b-cb7ef4680faa", "indicator--aa55151a-d9d5-4161-abbb-2f44b8b8535a", "indicator--de37135e-459b-4233-b2bd-e5f5f7805439", "indicator--3d3466d1-3d41-4994-8db4-689b69dcd6de", "indicator--8367ced1-de3b-43bd-893f-0e720d116bbb", "indicator--d200ddba-4b4d-4e8d-99de-b8a866870a4a", "indicator--acf1afa5-c552-4f3b-b8cb-7ca4c134cf9d", "indicator--3c5863ef-5d34-4519-bc8c-2657606ce702", "indicator--9ecb1ae6-2e4d-4858-96a7-4dab676cbaa7", "indicator--1c40141e-bfe1-494d-a069-ba07330c35e6", "indicator--9ccc5714-912d-430c-8d14-3c0f637631cc", "indicator--b556350a-674a-4ce9-a3fc-6c24ec41ed93", "indicator--c2a39539-c1ff-4a86-9315-98eb07592c53", "indicator--3d152594-5311-40a7-ba58-6ad1cce04e00", "indicator--176834d8-f2f1-4f4f-99c1-362e3943355a", "indicator--a5da96e3-2df6-4b73-9abc-c187f8457da5", "indicator--7870b848-dd77-4e78-8c9b-63af6742a781", "indicator--f580c530-9628-4cc8-949f-998c624f1dcb", "indicator--9be6e6e0-75d6-4109-b7d5-669907d48b69", "indicator--c36bc389-4704-4e18-a313-e0b519f364c5", "indicator--7634fe22-df48-4bee-9a9c-c921282ea60a", "indicator--e87e7bdd-f86b-43f8-9c3d-45764371dbed", "indicator--f6e52861-4279-4946-9677-6af847219d08", "indicator--a1adeab5-8acb-4ff2-a877-f795328fa5d1", "indicator--d2ba8765-598a-4007-8f5a-3c7a476e762b", "indicator--71e4ecfb-b74d-494d-9c9b-b758bd2e94c6", "indicator--dda048b2-fc4b-4c0a-b9a9-e807e6180326", "indicator--f8ec0bfb-688e-4efa-8caf-51fd9b537697", "indicator--660eec49-a8e6-42e3-a40c-04ebca045725", "indicator--373529c4-c9ba-4289-adc1-26d1d9504c58", "indicator--338f5603-93e2-4f6e-b3fc-170fecd241e1", "indicator--ad70426b-62fe-4aee-b66c-499af347301d", "indicator--d5473b0b-6004-4025-991c-90bc6d838242", "indicator--fbaa963c-5add-4060-a98c-c852ece6bbf1", "indicator--64dcb23d-8297-4111-82ec-64f5f880397a", "indicator--7fc33ba1-7e2d-451b-bc38-16f39deba7d4", "indicator--e24c4a6c-e877-4499-938c-66c5d7a6ec3f", "indicator--cfdd1e7a-0939-4271-afd4-453fc1d90316", "indicator--1f4dbe5f-18c9-41c2-8af5-3f1a7d8d1d61", "indicator--da09b1c9-6967-44ba-8c67-819cbf2dc76e", "indicator--2eca0278-2b81-4b0b-810f-e45f78e34a69", "indicator--1f032316-ad53-4498-9677-53d6d1d828dc", "indicator--5874187e-2b84-42fd-ba1a-0aa447c023cf", "indicator--2bea9c0c-d249-4e35-a0bc-f55bae91d7ab", "indicator--b882309a-ef55-4b7a-a520-b042f867b9e1", "indicator--83430945-1de9-404e-b03f-332e573f1570", "indicator--b6194af5-964c-497a-8bb4-8c024a0cff70", "indicator--d53d64ba-e88b-4250-b381-4dcef7cd9efa", "indicator--5153f1d4-1a43-4433-8c68-94dbace4bdaf", "indicator--f4e023c2-bb86-4c7b-85b3-a2bc8a1f2f6e", "indicator--a6af4057-1f70-40fc-be50-48e0fe984017", "indicator--5609571f-b978-40d0-b0c1-1bb834ffd7d9", "indicator--383445a2-7145-4d4a-bdba-ff2e2755689b", "indicator--12c73c21-00c8-4d1b-a8eb-75f7690e8ce9", "indicator--56558ddc-e3ef-419c-ac98-adae1ea907ea", "indicator--7ffa3e22-bba6-4379-8702-71fcfa3a6af9", "indicator--aab7927f-4bf9-42a4-b3a8-6a6a0a5fda30", "indicator--0b8abab3-921f-4414-bb1e-e0b8a4b3672d", "indicator--615bc7d4-1d55-428c-b25d-85d7918edd1b", "indicator--a3be6868-d692-4a72-a450-926daf4f2ee8", "indicator--dc8f3dd9-cf80-4317-9bc6-b432ad487cba", "indicator--0bba0c73-6b51-4719-af6c-294cbf435f59", "indicator--d6c37371-8463-4d0c-b316-46aa20a5c066", "indicator--a394543b-7e30-4483-8782-da54d429ee91", "indicator--9e80f5a0-6dcb-4a21-83dd-3a7fe7e691d3", "indicator--b3c928dd-eb47-409e-9262-ec991bfdd3bd", "indicator--e5f30110-8e9b-48ad-987f-53b67521b179", "indicator--2897b70f-0666-43a4-82ea-dc772e16ab02", "indicator--651d4588-3a99-4f1e-9cf6-d88317959599", "indicator--9d3b9e7b-2e39-4bd3-8447-7a03d472bc29", "indicator--cf8bbd7c-15f1-4bfd-b06f-23af9d4a6f60", "indicator--942770b1-9296-48ca-b7ac-dc8a475e9931", "indicator--bd472ed0-2915-46a1-a99a-17becc168323", "indicator--c50351f7-df3b-4ae5-9992-58a2014f1eda", "indicator--1326b90b-e9f4-42e1-ae22-c3bcdfc25b00", "indicator--4f009b50-7ead-493b-82d0-85e4ec3796be", "indicator--013da010-49cc-459d-a74b-32a7c2a42216", "indicator--9280dfa7-08a6-4d56-b5ab-5d58495dea52", "indicator--0428a419-e0e5-42b9-9244-31f5435f7212", "indicator--7f5fc722-450b-424d-946d-3839db7c5cc8", "indicator--5a311a48-f62d-47e3-a5a6-5a21c0216841", "indicator--800f8929-9608-4fb7-a706-eb6402d806ee", "indicator--ae8482a3-e329-43b8-b83e-921c4e927870", "indicator--ce23cbe1-c660-44bb-9b01-af0ea019c200", "indicator--a0b50e26-e756-4228-9b16-75e9b9453852", "indicator--117560c6-957f-4309-9220-e919002f323a", "indicator--a6958a55-6feb-42e0-8dce-aba359d29633", "indicator--a25d67b6-2d7c-4f0b-a7a3-7a04fdb570a9", "indicator--6c8eeba4-06b0-4a5f-bc83-a6e948f28c25", "indicator--2b57dfd6-2997-4faf-b2bc-d16650e7007b", "indicator--d719ebd1-26fb-4894-a86f-ec9d2bced6e0", "indicator--f16b8bc1-7b3a-42ee-bb16-ce18b0f0229d", "indicator--ab48d625-b6c3-44a7-92e1-c0afbf2826e8", "indicator--087be6f9-0155-4017-a96e-d4b9a11b7f88", "indicator--ad61141f-1599-47a2-973b-551157b2166b", "indicator--b678a549-cc3b-4704-bccc-3c1fb1eb6f2d", "indicator--ef134f6a-a238-4431-9525-beedb4fb2c81", "indicator--ad599015-5d3d-4492-a24e-a9ff830213eb", "indicator--33c656e5-4cb1-47a9-a930-b9c4efb153d4", "indicator--ced461db-1c0e-4fa1-9349-4738d511e1ce", "indicator--b134dae2-dcf4-48fe-a258-097409983af9", "indicator--02eaaa9b-ea60-41c6-b294-25fccb25d174", "indicator--281f5ff8-18a2-40a2-972f-c129122e4697", "indicator--3816a770-359f-4e65-ad1a-30833dd3982e", "indicator--53606745-fcb7-4305-9868-8edfea4308b7", "indicator--d8db713d-cb3f-4c32-bf71-8c61004a2116", "indicator--3eeb53a3-aaaf-422b-ad40-3638f18759de", "indicator--921f5319-115a-4c73-9a3c-e99421e4c8a6", "indicator--9a5e3155-a55e-40b8-bdd3-90a574fe498e", "indicator--6024b66f-0900-4b1b-8861-a1f5521d8088", "indicator--7f3daab8-0138-4b89-909a-ae6c261b0075", "indicator--0053373e-d798-4cf5-97a5-5bbfd9f2df6c", "indicator--a9b54e5e-0715-4b99-99ef-8eba332881d5", "indicator--a75e1224-2634-428a-8fa5-6ca0a44c1ec7", "indicator--d814afa0-f773-4ba2-a164-cc211a888ca7", "indicator--c1cd22a9-9498-44bc-965e-fdbb51d05a7a", "indicator--eaf56cfa-900e-4dad-862c-92520328379f", "indicator--cd7b5bd2-0821-4bc4-ba0b-d649847dcddd", "indicator--4100faae-6f9e-4784-b2fd-d7f2118a2e07", "indicator--a48eb42c-250a-4292-b76e-57fd389bcd3b", "indicator--5be533a1-69f7-4348-889b-5072ccc0e0c8", "indicator--157d6423-9bf4-4fc4-9e71-12e5d27082a5", "indicator--1aab990c-079b-41d5-b4cf-a48882f2bb6a", "indicator--dc4028f7-ddb0-4413-ae02-5ad77d25e509", "indicator--e39b796d-54f6-4347-b951-9fd6056b24e2", "indicator--ab718de9-d9a9-469f-9be5-e53ef36c2654", "indicator--01c275d3-377d-4383-ae75-b4925c40f77b", "indicator--cedea6e6-2251-4a13-9cdb-ff8f9edc871f", "indicator--f2988b06-5936-4ad9-b0b4-aabef7e84d59", "indicator--7590675e-ddda-4322-b90d-ee466f161414", "indicator--deaac993-cc43-48ec-a01c-84816e81217e", "indicator--d13f444f-41b1-42c8-9ee3-65fcc3a50c80", "indicator--6986931d-2bae-4496-b036-423ade09f426", "indicator--17785292-cb66-4df7-aae0-c836ca39778e", "indicator--78249e93-13a0-4c13-8c78-70ee19cca49d", "indicator--fa767fae-eb92-41b2-a2f3-a0bf41fd5d30", "indicator--862be180-5672-41eb-9f95-173306a93cbd", "indicator--d33fb819-0a4c-4536-86d8-13a72703a22d", "indicator--4efca687-609e-4673-8573-4c2fc18152c4", "indicator--d139e204-9f81-4d07-81af-719209f80697", "indicator--806c6118-2540-4c4e-88d0-afed691bdc92", "indicator--fe0da30b-dd5d-4b3a-a9c8-6828184efb5c", "indicator--2bbde6ac-e996-41a6-96a3-aa02a6688000", "indicator--6ee62dd2-d205-4dc4-80c9-4eebe447532e", "indicator--ea381004-dcb2-4060-a6d1-8be46a8bbc0d", "indicator--c85f7ec4-2ba7-4e90-89db-9f4492c771d6", "indicator--46bcda87-d734-44c2-be7f-9842ca517e99", "indicator--5537787c-75af-4cc9-9990-f673bf6a8bb5", "indicator--61bc3058-e511-4b2e-ba8b-68d2e9f2b67d", "indicator--0ca4fa6d-e0d8-42f0-8660-558934804cac", "indicator--0f40d53f-5f0d-4271-9106-24202cd0e4d6", "indicator--b7c5ccba-8dfa-4565-9107-50da36a35960", "indicator--09dbfada-d9e8-4ce5-9469-2844bd82d936", "indicator--0e399f1a-d421-4ee4-94df-f5d2cfd1ebf3", "indicator--e3539a89-1e6c-4231-b75f-8b260e8b23c1", "indicator--4fbb392e-b595-49eb-88eb-054a3ca4a8c4", "indicator--c4a2efc4-7453-4052-9072-5ccc1db387d3", "indicator--1b2e7040-bd9c-4e2a-8904-759d87ad4362", "indicator--d6648363-247b-43c3-96f6-2f03104d7a49", "indicator--c393dc80-2173-4dc8-b40c-9c6273861dc7", "indicator--c133fbdc-8eb2-4618-bba6-b9c7821dbd7e", "indicator--1c05e254-52eb-4d61-8699-cda8fae101f8", "indicator--d05ecbe2-01e6-4a70-86d2-5a2948f272b4", "indicator--f85f0c79-2256-43a4-b718-ba46d55ae4a8", "indicator--0b26d678-b5ab-41fb-8be5-2f3fba8a95fa", "indicator--8f240f0e-af67-4967-bad7-383961841d19", "indicator--320081bf-91c9-4e7e-9a58-16e9ea2225b7", "indicator--264a5daf-5f5b-43f0-86f7-8cb82efa1cf4", "indicator--a15b9710-1fef-41a5-9a7d-8004ae5241ea", "indicator--9dd9ce41-b831-4bce-b1fe-860aa51cd20b", "indicator--44e3d528-7c51-4794-bd0a-73bcbbbe0844", "indicator--cce7051e-af1c-45a4-9d98-baa0c38f681a", "indicator--2ba49248-b1ff-47bf-a8c2-1c2f00cac2ad", "indicator--0b20f112-caba-4986-bb41-7682c59aadb5", "indicator--54729277-2bbe-4a06-94ed-7fbfee89cc7d", "indicator--6d1ff5a1-87b3-4c85-9198-3955e8a6a065", "indicator--aca89e74-e3d7-49df-b137-103849791ce8", "indicator--c8de29e6-2658-4336-9e51-266e76c9ec42", "indicator--6f7d083e-a72d-4586-814d-5b8374accc2a", "indicator--0c5646a3-e2e2-4b7a-9eef-847c3808c0f6", "indicator--3df25f89-4b83-42ba-987b-d688e29f7f90", "indicator--0e2a3127-a274-4b9b-aa74-9cada1282955", "indicator--2f0f792f-dcc4-40d0-a0fa-b745973073af", "indicator--d096aaef-3b76-4ccb-8be7-2b0aa06d2fab", "indicator--c4b77ab5-1dbf-482f-8ad6-03bec9a1e7a2", "indicator--6f7374fb-374e-4b4b-8787-c59b35e219e2", "indicator--0a09a54d-cbab-4712-bb7e-b67f4a0a67bf", "indicator--49f4ce3c-2d8d-4231-91a3-4d829f8f6054", "indicator--ac85bce3-b11a-4508-a703-6e54a86e469d", "indicator--fabef1a9-75a7-40f4-b1d7-122a57e61bba", "indicator--9749eeb6-f779-492b-98a7-9f2a825105f6", "indicator--796a3363-dc94-4bb1-ae6b-0f8b01c68652", "indicator--eab5d6f2-c6d2-4dd0-ae35-aab4f90e506e", "indicator--32cd1491-d7a1-4660-b425-54fec1007190", "indicator--6def8efa-1a8d-4135-a3a0-a5a4a6d502fd", "indicator--ca366b26-9634-49c0-9c2e-c03b311bb6a2", "indicator--33fef1ef-d090-4d7b-a5e8-5e8962255efc", "indicator--36082a88-c0b4-4136-a587-9313e0e95c6b", "indicator--6ffb4e6c-e352-45ec-be6f-4c75e673dc50", "indicator--b5aa55e9-501d-47af-9fd0-2a91ce1b28f2", "indicator--27f6e178-facb-4a59-9e5d-18aba7590035", "indicator--b8986ab1-e34f-4301-b6b2-2a927d31654f", "indicator--d73a8b68-bad0-4e44-af86-782a220570da", "indicator--0d46a2ec-169a-4162-849a-dc139ca780c3", "indicator--8a8aa87d-28ee-43f7-9534-1db2537a7d6c", "indicator--7ac03bd7-e8ba-4e36-b280-dad3f4116390", "indicator--2ed8dcfb-668c-4455-a46d-fe1dc43b5c39", "indicator--8fc02011-f405-4490-a991-9f98258c1ff3", "indicator--6e1252b8-4bba-4501-97a0-29c4f48f986d", "indicator--9645acad-01a3-4a63-9d6e-0b806cc143bc", "indicator--1387004e-2aa4-422f-800c-194d47679227", "indicator--a1bb41dd-2c1c-4e26-a0d9-60db4703874d", "indicator--a018ba5b-b120-49d1-8605-1842c2edbb27", "indicator--c5d046d3-45cb-47b9-901e-2bc06258e424", "indicator--d7e6d8d8-1559-4358-a228-78f1b5f012f8", "indicator--11710bf4-f2bd-40c9-9f71-b3d29220ad85", "indicator--3f751f17-5b91-480f-9591-17ee5854d7f4", "indicator--f28d6db3-923a-412f-b27e-766ce0acc3bb", "indicator--4e0ee463-b3da-40a6-b49a-f414128955c8", "indicator--267374f8-c508-4b42-8c3b-1677319fac29", "indicator--15ef1fb5-882e-48a1-ac07-764c6b0ee945", "indicator--ba377cc5-bea9-4eac-a492-68fbab4da1b7", "indicator--8f76924f-2d02-407b-9d20-860405a37ba3", "indicator--9bc9cfb3-aa11-4541-aa49-3f18f7e9b4d8", "indicator--afa20b65-b43e-4893-8679-88877ae498d3", "indicator--6cb6a4a7-0613-4d34-b096-3410a3e91666", "indicator--c6c07f2e-6db8-4238-91de-e3d08ceedf69", "indicator--5bf0e489-659b-4877-bf38-9b4cf37647c6", "indicator--d9855818-6d1a-48dd-a64a-b354ef699a50", "indicator--e1b25d05-d337-4cee-977e-4bb929f8eb2b", "indicator--1f8f9ab6-b2ad-48af-8f8e-2db5450ba462", "indicator--2157e4b0-4f8a-4477-ab2a-aa36ba1084d0", "indicator--61823c12-b46c-4d9e-b4f5-0a1a2792a595", "indicator--8e0be64e-4728-4468-8da9-56fb05b6369e", "indicator--7091928a-6364-4998-ab48-ef16be6c367f", "indicator--4e49b844-36f3-4965-94ea-4a9f344c461a", "indicator--ec184d09-9a91-4cbc-bbc5-da9ecb7b518e", "indicator--036eaf3a-2e28-4e3c-abf3-8c6f27522410", "indicator--dd9fe8f0-a93b-4e83-a52a-b56f8ccaa91c", "indicator--8992fb9e-1c01-4b00-a030-8ca7f42b2c9a", "indicator--9cfc27dc-55e8-4246-9ba5-e6baca93335d", "indicator--861b0244-64e6-4277-9e11-fbfcd32cf937", "indicator--97156450-1b1f-46b2-9cdc-d1f44bf68fda", "indicator--0145f951-9098-4ee2-b0a3-17b79d79dbee", "indicator--bf6da018-fc68-4f6a-a56e-f2424a47c8d6", "indicator--040bf47c-771e-405e-ad1e-674789f2d39e", "indicator--ee336df9-ab8b-4137-8dde-14bdc8e933db", "indicator--988dbdeb-3abe-4a71-ac4e-3bb1ae01fdd8", "indicator--634910c1-5f98-42c2-b6c2-08f70fd46631", "indicator--a41fecc1-600b-4a14-90d9-76efc70e1caa", "indicator--eb1a1814-9cc4-476c-85c1-634283057e4d", "indicator--469b1423-2639-4b2d-a4e9-2be0755e72f4", "indicator--844b0127-576f-4d90-b90a-4bbc2e0b01ab", "indicator--c1a21648-7f9f-4c36-94a2-4ba6b67f3710", "indicator--4b895fdb-ecce-4054-a754-da10187f9680", "indicator--69830142-c8bc-4e5c-ae2a-615e31904115", "indicator--094defe1-490e-42ec-82f4-4364ccbcd983", "indicator--6956dca6-4748-4fab-9178-a2fb9ff084a4", "indicator--6e0f0bb9-9a8a-4fbe-85d8-b354a13914a8", "indicator--fdb0e73c-a4bb-4c6e-8346-26aa62127224", "indicator--e2012481-40e0-4f4e-9843-30c87f1d6d2b", "indicator--ae2dce03-c8dd-4f25-a3e9-19c4a5793fab", "indicator--6593803e-9ee3-4e95-80a3-c409f612ed89", "indicator--9ede5056-f0ad-45e5-bd6a-e541c36400f5", "indicator--36fc0efc-c704-4185-b5f4-8f77b856c0e9", "indicator--a4350272-5863-4a1f-8e28-54aa78166cd3", "indicator--76d48bc1-f71c-4a22-95d6-67ff5193fc80", "indicator--a89bbecb-76ae-43aa-a0e9-a9d8c00186eb", "indicator--0b8f1391-e205-496c-9197-e974cf9923ac", "indicator--7a39d5f4-112c-4d70-a472-0c22937fb91f", "indicator--98bbb3f9-5b11-47c5-8296-f2778acc72b3", "indicator--3d055754-d86a-4eb9-b131-52e16b179e72", "indicator--8e6f4495-fee1-4f48-a7ab-fca3f9278bd4", "indicator--c962c5f6-bdad-4f8d-8013-6cb3122adf78", "indicator--311c5f64-dddd-45f4-ae83-83a706cd9e67", "indicator--c36d750b-b383-405f-a158-edb1047db43e", "indicator--087b810a-e5a3-465a-a404-bc41a617ba02", "indicator--02e4b8eb-8216-4c88-aaba-588158306470", "indicator--da92dbeb-75cd-45ed-8aea-4969af735936", "indicator--e5b1f1cf-c3f3-4650-8523-dbe29140592f", "indicator--444a4a1c-1d18-42d3-ab0f-1a30b6fc23c7", "indicator--5a1ca20c-52e9-433c-aef3-0f95d21cfd57", "indicator--8c5ac934-c36e-4da0-9882-557c31d54f39", "indicator--bb757400-d5aa-4be6-ab7c-6ba5151a5bf8", "indicator--321bc0f1-cbba-4bfd-8f88-451f77b4d30c", "indicator--e669074c-2012-4b7d-b38c-1e8ab4a691b0", "indicator--69eae11c-00b3-4a89-b0a4-e8e8dfe0269b", "indicator--f259ebc8-d33f-4508-9165-3d0506fbe59e", "indicator--5519fe0c-0e89-41db-ab5d-9b26a2d0904d", "indicator--b35445a5-4669-4275-804c-45c6d01edb57", "indicator--78cb3d8f-de4b-405d-b87a-6949f97003a7", "indicator--b2ae1558-cb02-431d-aa51-679436652c15", "indicator--0c9bc18b-cb6e-4b6d-81bc-39ebac88ee81", "indicator--e8d9b37c-2bb0-4a54-8559-5df055a75df6", "indicator--455a1dae-8eb4-4a0a-8d14-cf4c7f5c4049", "indicator--1f15aad3-8d0d-4c24-95f2-61536cb4e776", "indicator--214c2951-11f2-43dd-8ea2-6a3b140d6eb3", "indicator--e0191bf3-a0db-4392-b7ab-2c73a98e1405", "indicator--c326fe06-8804-4e1b-a8da-e580c6362d28", "indicator--a4cc7d5c-cec7-45fd-b3ad-fd0f5d58dfbf", "indicator--b12fd95e-63b8-4625-8e40-911239df50d3", "indicator--0c80a813-d821-4713-a293-b30a410f6255", "indicator--0f531399-a3fe-49c7-b53e-698175cb156c", "indicator--0d5d5123-51dc-4f33-b0cb-4e4992b0872c", "indicator--8105eba7-e74e-4590-a830-aa119979450f", "indicator--0651ed6c-52b5-42a5-9aff-4ff37550d581", "indicator--f0ae748f-441c-4cce-8e51-03c1366b039c", "indicator--970f0680-723a-47b8-84e3-dc130eb374d6", "indicator--d13ea332-477c-4ba0-9a23-b3b15050a50e", "indicator--263fd5dc-6974-49e3-b29a-56adb4eaf08f", "indicator--a2802751-6026-499a-8371-0472401e8c1f", "indicator--68c7f175-910f-4970-b232-4f848f1babe0", "indicator--3b2ece32-47aa-403b-b0f8-be4a59176c4a", "indicator--74af9a8a-6d50-4e51-8d98-c80e6d0b53d6", "indicator--1dd1f1db-f086-49a9-aa0a-8a4fced75203", "indicator--36ee49dd-f173-4178-99aa-59590ad71a67", "indicator--4ce76033-5d81-4282-89e2-9fde58f28fef", "indicator--b8bc09c3-113d-440c-abd5-0edea18ccd10", "indicator--04ed04f7-ab2d-4611-81aa-1a2dbffe92c0", "indicator--d80e827b-cab8-44da-a4d3-a222d2f0d568", "indicator--db64e19c-d6ff-41cd-b5f2-ae88fc982fad", "indicator--3053bfe6-efaa-46e2-95f9-e172b09a2275", "indicator--094d73d3-bcd5-4a6f-a291-3b353492edc3", "indicator--e983b45d-4417-423e-960e-d92327b9a6ca", "indicator--6f91876e-c9b1-4e84-a20e-3b2c65c8e7d9", "indicator--54586b6b-8201-415f-a446-00edcd5aa425", "indicator--e423ea83-dae2-46bd-9cc3-07aed329b22a", "indicator--192ecb16-c955-455d-ace8-447df5d681d7", "indicator--016bdd7c-5ee9-4b39-a2d4-2211b3138f9f", "indicator--244df7e5-5370-4b62-b5fe-97d443fd0795", "indicator--035021bc-b331-4663-887e-fcf681ebf193", "indicator--e5f10871-a6c5-4d46-a627-159cbd88eda8", "indicator--2bc0b9e1-bc5b-49cc-b2c9-8b61674c2860", "indicator--8ec9e987-7036-43b0-ae07-1142ca05b5cf", "indicator--1c2e3a77-2178-4cf5-98ba-31c07dbab7e9", "indicator--68e845cb-edf7-4025-a111-36ba902e2d36", "indicator--96c3588f-9b81-415a-9a34-7dc04bf7adcc", "indicator--70612d66-7f47-414a-aba8-3a0b8c0fa26c", "indicator--fd0470d5-7308-44a2-8d10-8eff10a0afd5", "indicator--bff45381-fed1-47e2-8e3a-e797bc8ac305", "indicator--5520fec6-4782-4388-be42-cd6891d2ebc3", "indicator--df4ee3cd-4c2f-4ad8-9960-f06a2779af07", "indicator--086eb3eb-55ad-457b-b8fb-7d5936d7e649", "indicator--071c91e5-9643-4f71-b8fe-5b3e0f81ee97", "indicator--a0c4aaa9-25e9-4798-bbf4-5d5a05e2cbcb", "indicator--570655d8-d296-4d86-8177-70024fcfe3ed", "indicator--d332633d-b71a-4078-97fb-1d15ceb170e3", "indicator--c8add0d5-7993-41ad-91a8-1e7b3dae3ae2", "indicator--111088da-8f0f-409f-a3fc-36520b4865bf", "indicator--0e852f8b-67d8-4e82-8e38-b93b882686f9", "indicator--c0cd467d-0bef-4e22-84bf-7b4dbbc5c70c", "indicator--085a7b3f-fedb-4c79-b631-8f0e853f805c", "indicator--e6ded4b2-41bb-43cb-a081-59041de49199", "indicator--8f10a298-33af-4da6-85ff-b8279b6bd1a4", "indicator--d725eef3-e21b-406b-8406-2c17d193eeba", "indicator--ae61cb7a-9eb6-41f0-81ff-f6d847b1e9ec", "indicator--e1a26e80-9980-431d-8671-77715243b755", "indicator--ea0db830-0924-4a2e-a1c3-72c09ba73164", "indicator--33068c75-3859-4cc0-85bf-dc1221543871", "indicator--ecf19795-c3c7-4a35-b893-c0ccbe3d6296", "indicator--92c5b192-185d-4e15-9440-b8b20cf4d201", "indicator--ebc0e83e-821a-47c6-8ad5-8b7096676fc8", "indicator--a0d3b9c9-702a-4674-9220-c1df57a4eeb8", "indicator--d6a3070c-a338-41fa-a167-9e06bb88ed01", "indicator--afcd79a6-18a9-440b-86d3-ddf2d7e40f7a", "indicator--93d729ee-7ee7-4a2f-a993-fb939a1187b3", "indicator--624b5b93-b0a6-4a5b-ad72-9505047e6427", "indicator--db42b23b-3cc7-48a2-b8d4-1f2d8c806661", "indicator--331b0dad-bbcb-469d-8348-011ffdb864f4", "indicator--0c6045ad-6767-4880-bc41-d018b68bda07", "indicator--f81b31c8-24fd-48e0-b44a-7799d9cd481f", "indicator--ec795f5f-fdf2-494a-8f8d-2bc15f9d48f8", "indicator--7323a5ed-7b2f-4246-80b9-82b54671e1ec", "indicator--bd503649-65ed-4562-a549-bde19460658a", "indicator--826b0d6a-8258-402b-b306-89b00c2fabac", "indicator--5c0719e4-1373-4f40-9fea-b04a50b5b63c", "indicator--958f5b60-f1e9-4e47-8359-a3381e31c352", "indicator--920bb717-e2ba-4273-996c-6cfa3ff602ce", "indicator--51f7cf21-302a-446c-89c2-e99ed408906c", "indicator--59ba2549-bf51-442a-98b2-20bde672f87a", "indicator--80e6ab7f-7383-4ac4-a689-95d46ed04b07", "indicator--56540852-41e1-4cb0-8fc6-d3202192d253", "indicator--5de969f7-9e92-4b3d-a98d-75988f3b7a2c", "indicator--4863e35c-5f14-4d67-9d59-db998db56a62", "indicator--432df78f-935d-4b67-af9c-cfe647c7ad56", "indicator--4ff29ab6-bb3e-437c-b3aa-1de57b7a3ef8", "indicator--95440367-9650-4750-b9ba-4693e97003f0", "indicator--fb79df2a-b915-4b4a-b407-7c18b5092caf", "indicator--206ca867-84f1-4807-a414-1156f9a9b064", "indicator--39fe7aee-e9f7-486b-892c-a4f89c8850af", "indicator--eab95f37-08ae-41aa-b269-0158718aabfc", "indicator--3801d9e5-26e3-4456-bcb3-38d08a9ba0a3", "indicator--288067aa-16f5-4b82-8f36-55571b539474", "indicator--da91afdc-acaf-4764-8c4a-59eeab3fe39f", "indicator--598c9674-b35c-476c-ac5d-d4f29da23e61", "indicator--c08d6faa-279a-4f52-b2a2-8afe220c7ee9", "indicator--43818b21-861f-4eb3-b6e3-7237568fdf29", "indicator--b63b27bb-8611-484c-bc85-60153c55dfcd", "indicator--789d9907-7ee4-4f98-9006-01308ed0a410", "indicator--4fad2111-000d-4f8f-878f-a09881a957ab", "indicator--2b0c7a8c-d26d-4dea-93f4-231ffd2d223c", "indicator--53275931-8220-4071-9fc6-a3a50d77b85e", "indicator--d3dd64cd-6eb5-417b-8a86-d6f60ff4d659", "indicator--d27820cb-106d-43cd-bdae-1cfc869aa213", "indicator--3114b1f9-7a8e-453f-8a16-42ad73fb4436", "indicator--82f0a36c-bbfa-4448-b2d2-b315085d5e1d", "indicator--bc2b2313-d208-426c-af08-062bd7bafdae", "indicator--1b7df2a8-bc74-491b-92f9-1ccb32944b76", "indicator--18afe35d-d145-4278-9cca-a107da279abc", "indicator--1d0559b6-28ce-4a04-8669-a15ea03b5f7a", "indicator--cd612861-e6bc-4719-83c3-53f94306d3e4", "indicator--cf1b8bac-4417-4c2f-a5c9-5e8e0a941467", "indicator--b5bb01d5-3608-4e05-aaf4-304cf4f65fc5", "indicator--a4e08818-7d7d-42e6-beba-1afc2fbf515c", "indicator--68275d33-6cd3-4689-8118-730951443268", "indicator--1008257f-6cdb-4a68-9a48-52919b5abf71", "indicator--66f6d23c-0c4d-4691-8e82-6bc7d7ad8684", "indicator--8c1564f5-711d-48b3-8283-85883afd0d59", "indicator--e607804e-426d-4a29-84f2-b645a4c59a98", "indicator--81c7468b-ce6f-4546-bb95-0e71f9342b89", "indicator--e9e7f220-bf35-4e2c-9ea4-abfd4da25a13", "indicator--a7fc2b54-5840-48b5-93c5-4e50a1190be2", "indicator--f94d5120-ba7a-4e7b-9f99-c9c41023289b", "indicator--a7567245-005a-40ae-b0a7-217e03dfd6c9", "indicator--05464b7e-63eb-45d7-8b3c-e71d79855b55", "indicator--b899f4dd-05cc-4702-b032-f66853373724", "indicator--d41dc0d4-eb68-4131-983c-19efa5517dd7", "indicator--1ab1a9b1-c0b3-42e3-b314-7bb25198d9cc", "indicator--152285b4-7c1a-4e9c-a018-f3f1150b7338", "indicator--3f1d7170-595b-4621-9487-8c732f081b41", "indicator--952b1405-9c13-474f-a432-57394b28a550", "indicator--bc8878ff-4e53-4bcd-8cc3-b7852d434923", "indicator--4ddf2d87-fe3f-46d5-a40b-eee183a2bae1", "indicator--a4113307-9781-49b5-8c85-17cb0d60cc90", "indicator--66288729-b828-460b-af31-dc41e0c103db", "indicator--aac3dcac-5f50-4c14-8e6a-49e122846199", "indicator--12731586-af65-4e77-a0bb-26f355badb6d", "indicator--0c3cb718-b8dd-44b8-a03d-1ed2a0c9055d", "indicator--cf96c593-9dae-42ad-a266-088ca695559d", "indicator--6f753301-15f1-401b-8b93-112a600ad82d", "indicator--87815db5-f70d-4efa-9662-f0f0cba25952", "indicator--23b7e811-b0f7-44c9-ab37-a1c7e67dc4d0", "indicator--72a9b97a-5f6f-4154-aa78-5286d342b721", "indicator--c318068d-eb0f-4b96-8f91-7645f4f56f8d", "indicator--d4a8780e-1ec4-4303-a8f6-2aad396b6ad5", "indicator--540cd9e9-1fa9-4881-947e-5b8aa137a4d0", "indicator--aafa8857-8d53-4b30-b484-c23d2d380d5b", "indicator--6b056023-7ff4-4d1a-9b95-4bd16b141878", "indicator--c6eab4cc-9017-4cf2-84ed-9dff6d5c7a1d", "indicator--f64f7270-9ea6-42b3-9782-020fe9b5a3d7", "indicator--7014cfbc-28fb-4c41-9607-1fe3214c07be", "indicator--63f55700-cc5d-4046-90e8-e574d5349cdd", "indicator--292e1fce-c271-49b3-a4f0-8da8846b0865", "indicator--b90a0528-e5bb-47b5-8f86-33896e7aefd6", "indicator--dd34d941-6777-43ce-b153-ae0ef5f71f4c", "indicator--1b23ec19-533c-4439-a1bd-ac7b92898c3d", "indicator--d16457e5-f212-4351-8b1b-c3e149c1f54f", "indicator--ed2d2539-bdca-4992-99f7-cea636b94b66", "indicator--ab14f97d-d6ef-4eca-92bd-f12f26e0c371", "indicator--7dd08493-95d9-4404-b139-1ffaf26450f4", "indicator--2b8eafe6-29df-476a-9e31-8973fd494879", "indicator--5479fb4e-1dde-41eb-9048-ec747839fca5", "indicator--157bb697-bc2c-4cb8-ac23-1a9633e22ccd", "indicator--9e09b4c2-7c27-4db3-bfff-6962642c14b2", "indicator--7007b5f4-4347-45e3-a346-78c8f2339f76", "indicator--8c913ba6-58f8-4a33-9548-ef3da7294378", "indicator--ca39746e-c016-41a0-a2e2-e8b429e76ef1", "indicator--db908d33-2c63-454e-bb2f-bf5c49b3e7db", "indicator--6e761f31-6077-4d25-826e-e238df000d79", "indicator--4b153558-04fd-44ad-9b75-0e883e5afe20", "indicator--cc1a9b71-b208-4e29-8f78-303a108fbc5e", "indicator--9897a496-2700-425a-91c9-fba89aaca978", "indicator--d1166760-115e-43b8-b14d-eda01c167ce2", "indicator--761f82f5-c9d7-4860-915e-b1233b36ff09", "indicator--e6b0b5b4-e2b6-4dc6-bef7-133c30ac1111", "indicator--086fce74-fb84-4259-aa5c-99880b2797a0", "indicator--ac20d51e-9b00-4684-97bd-3ffc9397f58e", "indicator--6de06b78-6bdb-4d7d-91a9-596afd200ff1", "indicator--f3f5b7d0-a1d1-4541-ad4e-e5dfa6a851d2", "indicator--7d37defb-0600-4650-82e7-40cd919f7ee4", "indicator--97e9b09b-bb50-453a-b721-e5582b730c39", "indicator--92ef6387-9cff-4fb0-b083-8b792b443805", "indicator--2e0cc8f7-6a18-47ba-b3ff-6c74b4f3b254", "indicator--c02f3cbd-3b69-4be9-a60b-d1717bab83df", "indicator--ba6eac84-c4c4-4d0c-b181-d0ccb8954b6a", "indicator--343ffc03-54fa-4b55-a0ad-bc50cadb18e4", "indicator--40077c44-e5f2-41e7-a5de-7eb223f27554", "indicator--8b68ee71-e9b1-4241-bef9-32a53b4eccd5", "indicator--25196627-37e5-4efe-993b-78bb1e26d1d4", "indicator--71881f2a-289f-4fee-b092-8f771901b971", "indicator--0b2d02d7-256f-491b-927f-889e454abb09", "indicator--a4ad87c4-2939-4503-930f-6c36ac54dc82", "indicator--613e196f-2f0e-4fae-8981-e23dbfbd8a9a", "relationship--173ad835-61f7-47f8-9baa-64c68528fbce", "relationship--62a4958e-4e98-497d-8107-33af024f67c3", "relationship--b6b03a83-82aa-44cd-8a1b-bb8e64f41fc4", "indicator--471ea9f6-d83d-42c9-a2f2-05d2db9276d6", "indicator--69a0da0a-6841-4ecb-bda9-b9b826ab7660", "indicator--219b2463-8c2e-46a8-9f3e-842425255747", "indicator--394f0820-01d5-4cc5-9d25-1916cff56fbc", "indicator--8c0d5a6d-65b2-4ff9-9d22-438d00650ba4", "indicator--38e62702-cc06-4c53-9d2f-2b6c736e64ca", "indicator--80ca88be-6993-4583-a7b7-81721e6025cf", "indicator--e7343fff-709a-4f55-9124-1e3b888fb0df", "indicator--1957fb84-0df8-4930-958a-45165712fa1a", "indicator--d287d48e-445a-43df-9ac2-de8caff72bfe", "indicator--173823c4-7ab1-4ba7-992c-6780a448a4d5", "indicator--9b03244c-a51e-4352-855b-4918a6deaa4e", "indicator--3b162376-d2f7-4350-a2b6-7668dd28eeab", "indicator--40239e52-3931-4544-9ff2-150d3a2b03aa", "indicator--d15cf132-b758-4dd8-916a-02f04fed321e", "indicator--c8a17e73-7a82-487c-9641-0b78476c7e65", "indicator--afdafd85-520a-4815-ba1c-8d5425aaf333", "indicator--d2af9e3f-2daf-453d-80f2-0908689693b4", "indicator--f94277e8-1655-42ce-a64a-422659a12c12", "indicator--ad5f1e19-651c-4f65-8c3f-ca64512d7339", "indicator--06311e96-7bca-4786-9073-737c42c993cf", "indicator--9b8aa3e1-35fa-41b6-ae95-3a49fdafe428", "indicator--118a14aa-e356-4b85-88dc-641fcda2ebea", "indicator--236c69c4-f52c-4cb1-8a60-37efecb7be4e", "indicator--bb1f6fc2-11d4-49e8-a780-f542cfedb3a0", "indicator--9315f9b3-9637-44e7-b759-8f92367ff33c", "indicator--1207946d-ddf8-4451-b392-de38f44275fb", "indicator--14d0aee1-b636-493f-95e3-8d90663ed99b", "indicator--0df895fb-9249-49b4-a586-6e26fc74e584", "indicator--08651289-e06e-4592-b5d0-675e876940bd", "indicator--acc9973c-b410-44f1-9a04-7f41977cb16f", "indicator--c90ef75c-e3b6-4781-ab99-1a17dda17baa", "indicator--b18e464b-a476-4d74-993c-b836c0fc17dd", "indicator--d78963f3-a4c6-4b94-8f8a-26a17ae49b2b", "indicator--dcf618a8-5554-408b-bcc1-833e1d172f7a", "indicator--174b5680-9cc1-48fc-ba5d-f64a5598c227", "indicator--0a94214d-ed92-494b-8cbe-a777dd442ce1", "indicator--37eb6c4a-bf65-4ae6-87fa-f67afadd1e9b", "indicator--f564ecf3-d76c-49ef-9e08-d6d68e1cea6c", "indicator--d73a3529-87a9-4621-8cf3-a2c6823d0a80", "indicator--30f2046c-2e28-41a2-b60a-a659581f06a4", "indicator--66f13a84-d2eb-4f7e-9e9a-5fcb4739a548", "indicator--30813f15-1be8-4686-9ddb-55a5a96854a0", "indicator--afe7107e-527d-4ceb-9a90-59b214f0cc74", "indicator--73b8f382-3b0a-44e5-87b4-6455c685acd3", "indicator--a7d6728f-21a1-4c7a-974b-d85de4fbcb77", "indicator--34432e22-3f68-4892-b39e-b37dff09fc61", "indicator--3f2fd16d-5c88-4089-bd06-7c32aaef6cc2", "indicator--aa82ff6e-0a92-4406-aba5-619bb0b3cd33", "indicator--da1e0e6f-a393-4e9f-b57d-afab0e36d825", "indicator--40bf84c1-ff60-489d-9f10-b6cdc32f265c", "indicator--ea615564-28ac-4dec-b5a2-301530777974", "indicator--64083fab-ab4e-41d1-af67-80641f4a5b72", "indicator--1de552a9-08ae-4bd5-912f-a1fc1f01b9e5", "indicator--c4ff4837-9048-4d89-bbc2-efa831964363", "indicator--c4aaf557-22da-406a-8599-fa3d2ca1a052", "indicator--a5edca67-1593-4742-96d5-54a6e0fcf24f", "indicator--04252243-65d6-4cfc-b077-e448d9f193a9", "indicator--c8248f2f-6930-4fe4-a0ec-559bbdb0c90f", "indicator--42527bb6-f039-42e4-b8cd-4e64878ed841", "indicator--abfda40e-d5e8-44a5-abd0-af2e0ec63a5a", "indicator--8eac14b1-b2f0-4c17-909b-517da5fa6a72", "indicator--2cc76cf0-841a-46fa-b3ed-04c7535d03fa", "indicator--8651be7c-e645-4123-aeed-6a2ec1c5d15c", "indicator--58b1d5f0-f856-46b9-a011-c601fdc048ae", "indicator--7cf6e116-3988-489f-a246-3c0c95f9624b", "indicator--f2e35189-5f82-4788-9bbc-4eaf46687957", "indicator--d61399fa-857e-4511-8d55-fac9a9f75060", "indicator--415e13f4-2824-4183-96e5-910d81a7a85a", "indicator--02b5077c-69ce-4ef9-a2ed-863b9f58cfee", "indicator--bd41631e-535a-4207-8a94-8fbf9aca4ab9", "indicator--4271029c-7521-40e9-8728-4c7b9593a58e", "indicator--405ac2bf-a4d3-49ad-bed8-2e685d88b284", "indicator--b6f63558-03c9-476c-8a92-bc8072b3e71c", "indicator--9e36193f-5321-4ea8-b16e-c054ac98d65a", "indicator--099437da-019d-4333-a609-00f6e3164847", "indicator--66f8493b-64da-439c-805b-42585786ccfc", "indicator--a190d378-68bb-45e8-bac5-70b3756ab966", "indicator--c4ba131e-c6ce-4fef-a2a9-dd29504a30c5", "indicator--ae7581ba-e4e4-475d-af2b-12509069cb19", "indicator--8749331a-3c1c-4f71-ab73-d07b7621e3db", "indicator--53e79b4e-b47a-4fb8-bce1-5a650acdcc6f", "indicator--1fa57680-1de4-4d8e-b4f1-41b0f10782a2", "indicator--dbda70bc-9eb1-413b-9e88-f0512d73a43f", "indicator--929c26f8-c170-4ddb-b9c0-964498b5c766", "indicator--7d58eeae-052b-4342-9493-abad24f058ea", "indicator--04ea2084-7348-4248-80ec-64824cdfa3f4", "indicator--876312db-875d-490e-939c-639ada9d135f", "indicator--5181a423-0644-4c88-a698-a69870a861fb", "indicator--e76e940b-e604-4a43-9e6f-489bc9b0dfea", "indicator--4fd8dab9-dfb8-4199-ab03-719fc6110457", "indicator--45826fa3-d837-4a28-bc8a-9d33245e2d2a", "indicator--666a97dd-cc55-484f-90fb-364625e1debb", "indicator--b246cea0-16f8-4787-96a4-ed080f60d51e", "indicator--bcc2379e-d496-483d-ad9a-b6bb6f757bfb", "indicator--a27cb2bb-3ca0-4811-a9cf-e91f70e39851", "indicator--758d499a-17bc-4961-b7c6-7f23a3aec932", "indicator--7408b79b-0997-48eb-9137-074b87e2aebc", "indicator--e3aaa5fa-4058-4d1a-b123-c66c16f45cd8", "indicator--639e3e34-e6b3-4d3a-b55d-847c6fb2711a", "indicator--64f04304-9845-4b08-967b-603554268c4e", "indicator--b2e55c3f-35ef-4589-bc85-a9f161081e74", "indicator--55826723-2a8a-49f8-8084-2621e49d3d15", "indicator--608fc8c6-0d9d-4f4c-97c7-25caeb0a6eb4", "indicator--341045e7-a8e5-49a3-b3fc-acfc4e4b4e6d", "indicator--535c47dd-8b09-4699-aafc-8c3ec8ab978c", "indicator--fca442ce-c99d-41ef-b235-52c629b00e21", "indicator--28451920-ac97-400a-82d4-457ed7d71ced", "indicator--7c81c485-9583-4907-beaf-02ae768cdba7", "indicator--71d1d97a-9453-4e4a-b669-5f29f786c7cc", "indicator--36f10d22-97cf-41e7-bacd-9d85988586b7", "indicator--38cc06ce-3b96-43f7-938a-af65ac2fff1f", "indicator--5adc2e62-c17b-4991-baa5-f76e68999305", "indicator--09c56a41-3333-4e30-8024-6a418b7692fc", "indicator--c0f6a24f-ecc1-40aa-a8dd-46caebbe1d16", "indicator--d27e44cf-ae0a-4341-aab1-6cb53c24de87", "indicator--7fb0fbe7-b43f-4545-b964-24f8b5a3b51f", "indicator--f974ef8c-7f58-4d11-894c-a3ef300d5f6f", "indicator--d5bd5648-8146-4279-88fb-42f857f501d4", "indicator--432fd0be-08a3-4147-9559-337a87d57ef5", "indicator--f67eb867-46ec-4dbd-b8d1-497d9c342e67", "indicator--cad2c222-3b32-4361-91e1-b3ac51c98065", "indicator--2f799f04-782f-4ecd-b914-6c8c2194399f", "indicator--8f15997b-575d-4898-bb8a-23c5d9c3896b", "indicator--62bb2af6-79e3-4050-bf2a-10a2a0d11713", "indicator--40d547bf-65b8-4f13-ae62-4c7dce65ac07", "indicator--a85953a1-1e1f-45ed-a350-7859f4f03248", "indicator--aae419e0-8733-4bae-b17b-5a64f94771d8", "indicator--a8deb122-0b13-4684-9120-48e079d45db1", "indicator--27b3c194-91b1-4d7f-b2fc-776e67c651ac", "indicator--1267f994-e658-453b-91a0-33ba6583872a", "indicator--c5eeb423-4e8f-40d3-91e5-8fad233c1596", "indicator--b4325bd6-3a34-4eb2-9b30-d869f38e546a", "indicator--3de78abe-fb41-4b54-b87b-3ec14d0bdc0d", "indicator--60444e10-337b-4c22-aa39-b07bb17b51c1", "indicator--217feb73-2917-44bc-b145-ade8b1d2fc73", "indicator--f97310ae-0061-4394-bfd6-f52f8cc2dc4c", "indicator--a5d8ebc2-63e5-4d96-9ed0-f61ac51a9775", "indicator--ae74a084-e8f2-4180-a11a-9384efc54c64", "indicator--d25cb624-333f-4a2d-97dd-eb2a96ba7ff2", "indicator--759128f3-5b81-4049-b67b-19531c5abd33", "indicator--7428059f-ac8d-4fff-ba57-7bb79cc03d41", "indicator--65d088da-24bb-43ed-a556-ed7a29285ed1", "indicator--92fcb14c-7377-4fbe-a89a-ed11c68bc40d", "indicator--4f4336c3-1d9f-4879-bb1a-9637f282a73b", "indicator--985dc409-1571-4ed4-8ef0-fa9de23ce6f5", "indicator--e6a91b2a-8902-4dfd-8452-b7612ccbf45b", "indicator--ca48025c-2710-41e3-b7a9-b2d462785d11", "indicator--5e32d42e-1b19-4a51-a327-5e877069c5d4", "indicator--95d09e52-bc53-4cff-8ee8-d8fd9626b4b9", "indicator--87a349eb-acc7-4ed8-971f-ad87691a8773", "indicator--26cf66a2-ae99-4d39-ae28-de51d816bcc5", "indicator--cadf5029-6d14-4a63-a710-39f8e0be7091", "indicator--4a8c3d81-68fd-4819-a10c-dcef3007c9a3", "indicator--df2b7c25-5ddf-41a5-bd71-18792f684281", "indicator--389db86f-d394-405d-9f0d-b313ab113f04", "indicator--db9ca23e-ba4d-49a8-b39c-ef1b7bf6fb97", "indicator--a6140b08-8880-4e4e-93af-79cbe65a7b0a", "indicator--85ee26aa-8887-487a-8bee-040893d0f437", "indicator--84bd1545-e6d1-451f-a762-fef3ad550581", "indicator--a2960a71-0f8a-493d-84e3-2db72eb7ed44", "indicator--90d95969-76c8-4453-901e-a99bf78ae23d", "indicator--a082d53e-d484-4f01-9562-6ed38e70f997", "indicator--402d785d-b0ce-4068-a3d2-ca42bac085b9", "indicator--b9090e5c-a029-4b21-a940-4e145d561439", "indicator--0a5570b8-fd15-42ca-a3a3-de0c113d4231", "indicator--a7fed5f9-a103-48f0-8b8c-6ce6b4575a53", "indicator--80eabf92-e047-4add-bb33-2c18a0457c7b", "indicator--d89d3e4b-df8c-4ad0-9d8d-56fe99d6e59a", "indicator--ab16cab2-6458-4497-8248-a6c3ef198cd6", "indicator--5280fb8f-5d76-409c-b564-e6fbde0ba8d2", "indicator--c00ef7af-80bc-4d7a-bcb3-553cc6675f09", "indicator--83be64b7-4b07-4c5b-9f37-aa1a3275b466", "indicator--3372a415-98a6-4a5a-aa01-43041094687e", "indicator--64461d40-4fb2-48d7-b8ba-54f13492c72a", "indicator--94b944ae-9fe3-4a0e-82b4-7c479b2bb903", "indicator--74e984f7-c9ac-49df-9062-2174d47367d5", "indicator--83b7ac34-aa00-44b6-b052-408f0be527af", "indicator--4aea3e42-6076-4365-957f-e22863c3fd03", "indicator--e841c0c7-6051-4334-ba93-781f97088c84", "indicator--949431e6-318f-4198-9f4e-20618a8e9baa", "indicator--c2807ca2-1731-4781-aabd-a0449ae3fa23", "indicator--c2814c59-4570-4831-92ab-c5e128085c19", "indicator--cf5c8bcf-842b-449c-883e-d50fd969cdb9", "indicator--59d53248-a697-447f-9985-699258c6bbcc", "indicator--52aacf5a-b180-4ba4-b8d2-089d57744e3f", "indicator--da666e51-e1c8-4d58-9a0f-bd1dab880082", "indicator--599f1bd2-c444-4045-8deb-00c8fe56c589", "indicator--bd392572-7736-40b4-9b2e-e112f2797b7f", "indicator--6f1fc813-bdd9-41aa-bb33-34349b559447", "indicator--e17dd8bd-76e8-472b-852d-13fe06fb02e9", "indicator--c5ab33bc-c80c-407b-854e-441f41620ee8", "indicator--c73b5457-bae0-4b80-8cd3-620312280b23", "indicator--00d68712-6f9a-4ff8-a7d9-b347a7234ee1", "indicator--10ce28bc-c376-4252-8439-11e7be9e00ce", "indicator--9d5af20e-e9ce-491c-abd0-d6962db91a89", "indicator--1c7d6530-971b-400c-bff0-739b6710f2e7", "indicator--84b34cfb-6558-4c80-90e2-c9098c4de214", "indicator--f69cffd4-2fda-40a3-96ef-f21fe706d672", "indicator--593739bd-7172-4a7d-8896-ca9bceea63d6", "indicator--0ed8c94b-b173-4c15-a4f3-d982388590c8", "indicator--93fe9e14-c8a3-4c63-8a66-5a6a90a7162c", "indicator--22aee456-b02f-445c-96be-2de07adde525", "indicator--22348361-9c1b-48d9-b6d8-a8f27e28a227", "indicator--87b94073-c427-4e3d-a7ba-c2d876c26ff0", "indicator--2056a8c1-1154-4acc-87af-0c220df9cd1a", "indicator--2952f083-c15b-46de-bd9c-ecaefe3eded5", "indicator--b04bfe87-b3ba-48b1-9bb8-df97ad267ec3", "indicator--ed9fe303-6332-440d-b4d5-57dfbacd8b9d", "indicator--4b94383e-c26d-4ef4-9f54-127191525245", "indicator--bdd12224-76ab-4fab-acbb-b129bf247822", "indicator--8ceb2b66-f954-4e59-8295-02b3d5a0fe3c", "indicator--9aa0eeab-e9a1-4bba-a105-04c0b6908e7a", "indicator--67e084bf-fab5-42ae-a92f-cd8a9302007e", "indicator--ef25aa51-7375-4967-b00e-bbfe9bda8eff", "indicator--8c10eee9-39f7-48aa-8656-600fe5e7c8dd", "indicator--b9b09d5b-7954-45dd-a678-30339dc011b1", "indicator--910e5e3e-c79e-412b-8acf-a9e848488eb8", "indicator--ffd3411a-1512-4162-8db8-ad140b7184da", "indicator--202f7584-81aa-4d7a-a304-77e5cbf04f13", "indicator--474e0777-723a-49e0-b30c-29111dd7972d", "indicator--ecb9d607-c293-4e69-8f5e-532977a25cc1", "indicator--2d70a59c-8891-4f87-938b-0e52089913c2", "indicator--bd9f2a05-ae7c-4e70-92ca-c5b227097cd4", "indicator--151159b4-da08-4ea0-8bbb-a13ccb38f4fe", "indicator--204662df-d96e-4b9a-ad77-8e3f696f043c", "indicator--e8d4c0eb-d1ce-43c3-8e20-f5282447ea74", "indicator--869a0617-fb34-4a74-abd2-dec8d5a3fe99", "indicator--f0ad38a8-aa16-4312-ab7e-960c2b277353", "indicator--df6ddd01-1402-487a-a4ab-9f4ff105e89d", "indicator--2c78539a-084a-412e-bc7a-e2b2c6cd8dc2", "indicator--20cab1c3-d457-403b-a7e6-0e38b243b434", "indicator--decab3c3-e0fe-40d5-ab72-164ccdebbe7d", "indicator--46b1fd94-c1d3-482b-9001-721756a2bcf3", "indicator--a2d89c3a-fcab-446c-87f1-464cda111014", "indicator--5fda573a-0c9d-4f7b-887d-406d50312ec0", "indicator--e0efe9c3-214a-4648-adef-0e7470cb3ea3", "indicator--39d5197e-73d8-4530-a464-b3d3269a3281", "indicator--43914aa9-1b3d-49d2-9f34-02f3e03aab6c", "indicator--33cbeeab-bf83-453e-9ce5-41e5b01e67e9", "indicator--5010713c-0c5f-4f1c-a6a9-98cd89e66b21", "indicator--1c53adb7-8316-4f1c-b68d-87602d4515e3", "indicator--d6fcd535-a6d2-4152-9016-bfd3483faf72", "indicator--bb717679-29fa-46bc-801a-e30f8b21b9c4", "indicator--a63ca40e-8d2b-4cf0-94f1-7c23426598dd", "indicator--5de354fd-aa89-468d-9633-cb8479453a40", "indicator--1eae3cab-57c7-4380-8eb3-349dfd00721b", "indicator--6298a2f5-da08-4cf4-bf94-bfc331db4241", "indicator--30f589e1-3ae9-4801-9a49-8460ad6a39e8", "indicator--8a23886b-426f-4a9c-af63-f92fe13aacfa", "indicator--178fe9f0-d078-4d1a-bbbe-6d44f45725ee", "indicator--aac0561d-2340-4847-ae14-19e5957c6988", "indicator--79374542-9496-4cff-a101-aa5b9b2aed7f", "indicator--b927d134-61a3-411f-b116-4c9d00c228bc", "indicator--84193a46-895b-461e-a802-d9f63b670d3a", "indicator--fc21d172-8b9d-4e7f-afb0-52c3709ee208", "indicator--9437c52d-7a28-487e-bc26-272ae5e6040d", "indicator--7d808d1f-95fd-47a2-9b0e-91bd2e70dae2", "indicator--377b7440-d6ce-47f6-88c0-6718a18e4e79", "indicator--20140924-52be-448d-97db-eee14d66d070", "indicator--68c05067-8a89-401a-9db4-0d1b537b9477", "indicator--64980efc-9e45-4d57-b7db-8ffaf60adf63", "indicator--5655c358-cf4e-4500-aa90-a61750c75a65", "indicator--b4da0689-fc0b-4e0d-b407-0913a069a918", "indicator--673e629e-bf73-449e-ae67-27d0ef5a4c92", "indicator--7cba0c3f-deeb-4006-a3b4-84a108c5d9e2", "indicator--5cb92f92-fd31-4a1f-9b3e-a7e220e80f7c", "indicator--14133ed9-3b68-4d4c-b211-1d1e376c89d3", "indicator--604f8da3-e28f-4877-84b9-aa5892afe025", "indicator--13503b0e-7100-4cd3-b1c7-05cc6f9bdb97", "indicator--ea60a12a-f1ba-48b8-afa1-dc54fe462ea3", "indicator--54e1838d-664b-474d-a37f-aad96212ce70", "indicator--95fb4a8a-cb77-4d84-a233-d235c47900e5", "indicator--e1d36a06-fe00-44f2-ac69-46b99e97e58b", "indicator--d1fb30f9-aaec-4998-befa-03815492a685", "indicator--209975b6-9be4-41f5-a768-494af4d0a457", "indicator--40c94f85-d4ec-48d8-8618-474828364e23", "indicator--a7e5487a-3ee0-4280-b3d1-3240d1d6a847", "indicator--73d2f4e3-46c9-4ec8-9d85-59675b135922", "indicator--fccd5407-ae0e-4d1f-b200-1086cb5fd425", "indicator--e40f2f90-b78c-40a9-b005-0ddce2f17d30", "indicator--b90250a1-2ab2-4445-8785-2ab473c17f59", "indicator--34efead0-460f-4782-9859-2fe99e0ec0c2", "indicator--18f36ad7-21f7-4cfd-8a2c-ca39259595b1", "indicator--f351d786-daf2-460f-985c-b3fb76c655ed", "indicator--c293a036-e717-42f5-a304-087739e912ee", "indicator--f81a63e9-14b2-4976-b87a-58c736fcca1c", "indicator--e0a11fa5-472a-47d9-b965-f79cc2b0dbf1", "indicator--37ecd574-f69e-491d-8048-f13b6e9d7edc", "indicator--aad38c56-db2b-43f9-b907-e61f82c0e4a7", "indicator--7c7ca684-afca-49ac-8df2-c0c7f4911ddc", "indicator--611a07ce-406f-4abc-957a-c185e9e4104e", "indicator--34a386ae-7486-4e70-91ec-2a02ee10e423", "indicator--6b3d07be-a2e4-4632-a0c3-3fce4b00094d", "indicator--05fd53bf-dde4-4bef-b473-f002d1fcc6fd", "indicator--6fd8dd76-1efe-4d75-b5c9-833727eeec18", "indicator--c42beef2-90c6-4a8f-b37d-f9f30c945e5c", "indicator--6a828d91-2930-4fbe-b0ef-08141126509d", "indicator--aeb15dcb-1617-46c9-ae6a-39b12689b6f2", "indicator--42ae7952-5229-45d6-a1e8-4d839012c40c", "indicator--075fa10c-0747-4a6e-bbe2-6d4399b6d5fb", "indicator--e07a5b2d-f76e-4a45-846b-d28f69fe67cf", "indicator--9f154c3b-1b0a-494a-ac81-58af9e184ebe", "indicator--c8426f8a-5f2c-4e0a-af2e-7aa4e79c1566", "indicator--48818cb0-d766-4c33-9ba7-c8071b2d7a76", "indicator--cfb30408-c173-447b-a689-715dc1943356", "indicator--a595b726-8b3f-4218-9173-2e300561cd62", "indicator--8395f59f-3a70-41aa-b9f3-6b9663ddc5b9", "indicator--2afca9fd-3af4-41d2-87f9-926be9eba7b2", "indicator--51d9166a-a7d6-4dbc-ae19-0b65afde34b7", "indicator--ed7cdda2-cad7-4eeb-a906-936a23a1f09e", "indicator--20306961-5622-4c61-bd3b-fb8f8cf0bcb9", "indicator--91a81106-5456-4765-abd3-a0a07bc45cc5", "indicator--254c3ee5-e69f-426e-8bbe-3064e197f069", "indicator--c6992c20-f0bc-4fbf-948e-ebc998fa6fdc", "indicator--b6d5ffc9-76bd-4e02-b53a-98b8f63a8a56", "indicator--52d5e092-3dd1-410b-bf30-cd2908ae8209", "indicator--b67ece35-74b0-4bfa-8c93-189704a5a2a5", "indicator--bcd21ad4-05c7-46cb-87f1-e2adb8dac10e", "indicator--31b7ee7e-eb2c-4520-94cd-d4c0856a2cff", "indicator--dea39062-b0f9-4221-b089-2b1d59a3f166", "indicator--daaca6ec-b69f-410d-b442-e89033dbf95f", "indicator--702b5f15-1453-48a1-bff5-d1e99bbc9b5d", "indicator--c3bd110c-933f-4194-abf9-401429c21e25", "indicator--82121541-7d6e-48c8-93c3-7b6792540754", "indicator--177783ac-d9db-4cf4-89fd-70fbe4c262dd", "indicator--289f6cd7-7957-4980-a238-35178c66f79d", "indicator--3514487e-f5f6-4907-acdb-6593057957c7", "indicator--5a653faf-40e8-40c7-8a24-68568031080f", "indicator--c3309da4-8bc9-490e-895d-3064bb8b268c", "indicator--087d5d1e-5ce3-4aba-bd91-223e1d64ff67", "indicator--7b628f15-1a2a-4520-a0c2-40030584a45c", "indicator--a4f78f2b-e293-4d85-adb8-ef7f8b124a79", "indicator--e39fb055-6612-4c80-9b39-b065a65052f0", "indicator--eff5882f-cb1b-43d4-b1de-9fec7dff1d2e", "indicator--92cf7cb7-8f29-4de9-bf03-4024a54b1ad3", "indicator--3fe5475a-46ca-4af8-a459-18a7311ef2c1", "indicator--5af14483-092c-4ff7-b12a-e37821c2fa31", "indicator--7ea1d8df-b2d9-44c8-b0c5-04f6b165c722", "indicator--11672e85-e7a2-4994-a6b5-210a460d8098", "indicator--c6c972b5-d0eb-4e5c-9333-1ecdcae9d328", "indicator--fac5f3d4-f782-4cc0-8c46-d64bb9219383", "indicator--0acf6471-dd73-4c66-899c-da676c6b304b", "indicator--739963d3-36f4-4958-aa68-aee97f7dd0a7", "indicator--b121bdc9-b335-4c49-b218-d38321a10242", "indicator--335c453e-8d2c-441c-be28-c9f1dd34b7fd", "indicator--f6a5f37d-f9e3-478a-9ddf-7d433d8c9f24", "indicator--60fde42f-cf9c-4f2a-81d9-a462a5ba6abd", "indicator--fad7959e-46cd-4ada-a825-ea4d326938bc", "indicator--302721d9-7bc2-4050-86a1-554a3dd7a21a", "indicator--2de2e82c-82ab-4234-b2a9-ced79aa22a6d", "indicator--b27c43bd-f761-462f-b757-2607e9c96d71", "indicator--192c9540-36e4-4d90-b68c-bc5a244477fb", "indicator--4e89b93c-c83d-4510-a55c-39b321f83edd", "indicator--6f5e7c77-e030-4d62-a4f3-d811949a278d", "indicator--16cde4de-e721-444b-9c53-aa910d6e6498", "indicator--54231a41-68d4-4fed-ac2a-22f2b895c2bd", "indicator--cc547ab3-2976-4fcf-8465-2a254abdcf8c", "indicator--3a4f1025-4fa3-4837-a76a-7184916c6d00", "indicator--d659e16e-82a8-4493-b77b-13c01dd14a0a", "indicator--28320ddc-06d5-4fdd-bf6e-78af53ee43ce", "indicator--99348ddb-24e4-4ec9-972b-d40b4c90cb83", "indicator--1b42142f-9b53-4fdb-9f2a-66c01a265fbb", "indicator--c78111f7-3197-48c6-8e71-5cf57eb51742", "indicator--e51fcc1d-5e64-49e5-b5cd-6b1b3d6d690e", "indicator--51312de8-eb54-4fdc-9f44-fcbf306fd836", "indicator--6b21a982-1f75-4f9b-ba0f-7e04573cd1b2", "indicator--9a385be6-264f-40f7-9420-65b4fc242ff7", "indicator--be483a87-4ba6-4064-a803-15f90709ca03", "indicator--a7e728ed-85ad-4a41-8a7c-29131072b37f", "indicator--20a797b9-1bbf-40b5-8681-b98deac269b7", "indicator--2956537b-6b3f-48ca-8f86-e2b652225b57", "indicator--2af8255f-a8fb-4004-88f8-ca2eea22d64d", "indicator--f1e1d4a4-d794-4099-acf5-36bf362aba3c", "indicator--18ec7de5-16df-44af-9d2c-fd7a432c86e6", "indicator--a8f2474b-98ec-4998-8ebc-b0358c1f5d37", "indicator--23a4072a-b33c-4339-ab6a-d88361bdd273", "indicator--990da301-c0f5-414a-8385-cabbb566a916", "indicator--3ef7a0b5-09fa-417d-a3e1-c27bcee0e43d", "indicator--4295ecd4-eb4d-4aa9-8efc-c47a1b658fed", "indicator--f774feb3-d0b5-445b-be49-e8345c800609", "indicator--9209e99b-16dc-4648-84c2-dfaac463194e", "indicator--3bd14d66-d8a6-4d9b-8f19-bd50b4544be0", "indicator--2bd8377a-e67e-41b5-b897-9dc212569882", "indicator--f142c26c-b9cc-4664-9a38-039690371c0d", "indicator--ea89c3d2-fcba-4843-8016-c6034368473c", "indicator--1a25fd57-b847-4304-8413-23593507f553", "indicator--1839f1b1-7303-44bf-9c37-d18e12beccf5", "indicator--391dfc66-54ea-4c51-8321-6c2fbc713aaf", "indicator--5dd22969-9304-4022-a26e-141056834b02", "indicator--b586e1b2-1e46-4401-8560-d7f44e4aa915", "indicator--5b4cab50-ef4f-423d-a88a-f11d09fd4669", "indicator--88dcb5f6-46dc-4045-a2ae-8fef306b6380", "indicator--8672d9f6-10b5-4149-98a6-d3dd9503198c", "indicator--462b3900-0588-4344-b0a8-34f2c53e7812", "indicator--eacaa379-45fd-45c7-aabd-22389d6db09d", "indicator--b30d517c-d593-4019-b9d1-6837e31a2ce9", "indicator--226865e4-b460-4c4e-95dc-c1978d506aca", "indicator--570946ed-9f89-4cac-a4db-dd25c011f78f", "indicator--541d0d72-a330-4037-8b8c-015be81675b1", "indicator--d323f863-e75f-47bb-b7f4-5246c3876e22", "indicator--22b268fa-1a63-4e3f-ba06-138ac836361e", "indicator--e53fc52a-39a7-440f-b6fc-5d27f7696ab1", "indicator--0e6a2d6a-50c6-4e52-bf46-286f3e0a4e95", "indicator--e1110fd6-ccb1-4dcb-927a-25d35a4f4578", "indicator--1e036a4f-09af-4225-9d13-40a2cf062361", "indicator--a165c36d-db9f-4753-9bbb-74da07b73b4e", "indicator--458429bc-d462-4c54-8ef2-03864d05fde9", "indicator--ef4a1e39-6f64-41c8-a55f-959dbc65711f", "indicator--1ecbc374-8886-4087-b621-c87839343f70", "indicator--59619ae4-5b9d-4278-a633-d9e942133220", "indicator--8741a826-ee37-45ae-aa8e-984a826909f9", "indicator--7ee5fa4b-105d-4a90-acce-affea240cba8", "indicator--0c6af5f2-b9f7-4e7c-bdb5-44e0f5f5d20f", "indicator--1c6ac772-8c47-4ac3-8ad8-f4103cee6ea5", "indicator--83a68ac7-4abd-4ba2-96fa-3b2f0376d022", "indicator--4327a127-511e-47be-917a-61deb937a527", "indicator--e6eebf38-49f5-4e27-ae17-3aa250db1d74", "indicator--30e67e9f-ca96-4b7e-95d5-eaa974281327", "indicator--a299b239-94f2-409f-9dec-2d72a4db09b0", "indicator--1b6f769c-0600-451f-864f-fa7a9b8f4697", "indicator--c0a953a2-12bf-4198-85fe-1d9b158e2fa8", "indicator--4970120f-a2d8-4608-9aa0-1a10c92b566b", "indicator--aff77cef-ed82-4249-a367-ece23454b446", "indicator--4f499b2a-3302-42a1-bb81-4c9f8e614736", "indicator--9309af40-779f-4515-964c-a0567bbec840", "indicator--d39979d6-2891-4947-ad27-f2d4cff73a4d", "indicator--678468d4-6716-40ba-8c15-0762a09bc5f8", "indicator--550dce9c-1d70-4a2c-bab5-92d023440385", "indicator--b427f411-79be-4e07-acc9-c44672080398", "indicator--45d78c5f-fea4-4263-90c1-220018695928", "indicator--87e31679-4516-4358-85e7-356831c5a5dd", "indicator--38d67ab7-b093-4ca7-bfb4-227a6e4f3267", "indicator--e8747e4f-bbc4-47f1-b961-dcf2d1e5011a", "indicator--2f135e91-2d2d-46a8-9622-ed8e6c5a854d", "indicator--b3d2a189-9bbd-4af7-931f-0ddb37b7b679", "indicator--e32cba93-8d74-4f24-9b7b-f2027b589f0b", "indicator--780823ff-466e-4739-bd42-820114eae61e", "indicator--1b850d95-ae3d-4af3-919e-e43ccf5ee059", "indicator--ccb5e00e-7ab2-4116-8e79-cfa99b23b2fb", "indicator--e84f51df-a9e9-41d2-9a54-41aee4c48db7", "indicator--d56d3e0e-d288-483f-afd9-2c28e0215b84", "indicator--fd45fa01-b314-4163-8c7e-4f38a3a66905", "indicator--616bd33d-54ec-401e-8051-05a4b8b3f445", "indicator--68b865e4-0c95-4b61-9f01-e01dd58479ca", "indicator--18cc414a-d9a8-47aa-b5dd-21b661ac1d21", "indicator--48b9bb9f-2caa-426b-9da4-575673d5b044", "indicator--577fad38-dcbb-48e6-b172-4b275e2c5a93", "indicator--87121209-4df3-42ce-bea5-0a562dc07f53", "indicator--36260ec0-2cfe-4827-8d52-6a685d0b259c", "indicator--6e78fe09-6b35-44b1-9410-779ddbb339db", "indicator--40abd406-ab32-4fbd-a8a0-dc2b838ac18f", "indicator--9f577906-6871-45f2-885f-6ddf13a914e6", "indicator--b4e6d254-c06f-473a-86e4-922cf5de47e9", "indicator--e80e6d99-00f5-4010-93f3-066482a7242b", "indicator--dd95bf75-49fc-4cfb-819d-7a6dbbdd0a33", "indicator--8947bd20-76dc-4776-83dc-4c54c21f33f9", "indicator--c5b71ba1-478f-4154-a823-c9d9557ca8a4", "indicator--712e9c4d-b45e-4fb6-8988-cb7331a94579", "indicator--20dd0300-dfa3-48b4-a8f5-d9dae24de77f", "indicator--80fe35f3-4785-4a3f-811c-e74c2e27a125", "indicator--2f5ee8a9-ccff-462c-8206-1220c1432438", "indicator--47b4620f-8378-4624-8256-351746b77672", "indicator--40da6a97-8e6a-4355-a763-7b5aa958406f", "indicator--94eb3e37-1220-4b28-b2fa-58b2b281f57a", "indicator--3ae6b640-527c-42a5-9450-b8edb1c8d476", "indicator--52f4141c-5514-42a7-a97a-3ff9dbdd8961", "indicator--d062251d-5571-4aaf-bad7-24f69bbe88cf", "indicator--87f6bb21-144e-427b-ad48-a29eddeae343", "indicator--e6190452-9135-45bb-8780-62792cd14710", "indicator--5c777204-bbfe-48ce-9deb-c5d7b373962b", "indicator--f35be3f6-c672-4d6d-930e-800cef4d9827", "indicator--962a6cea-0ea3-4a6f-9f83-bf35c04f386e", "indicator--a20da0a3-3908-41ae-aa87-d9850aa6136f", "indicator--71c79816-20b2-4129-8271-4565f5c302ec", "indicator--ab53144c-2b0f-4b2b-8ba9-cfed1c2d83ad", "indicator--1025c634-3492-4011-a859-a8a123057fd2", "indicator--d475142b-a3ed-43d8-a016-4244910d7c12", "indicator--d5124d83-ed0b-4072-b934-921ff57f1afa", "indicator--332dec8f-c54b-4df8-ac7e-af4f03e2d077", "indicator--8c3e8604-1bcc-4e2e-85b1-41864282067e", "indicator--fb9a59e2-6266-432e-9429-e3d824297e4d", "indicator--6e2390be-5f8d-4791-a2bb-4806d0c6babd", "indicator--ec86c81a-1a45-41f0-b17d-7db608b144ef", "indicator--720f5886-a199-40ff-9142-5bc293481e20", "indicator--fd669c6b-b27c-4d12-b5b3-388de28c30cb", "indicator--f559ca1e-6d38-4e4c-b5d1-f8f6bf44ce7f", "indicator--4d95f628-c051-4f23-a0b2-c997bad0df0c", "indicator--21de6bb9-a249-4137-b858-226184d886f5", "indicator--b836fc67-e9c0-428a-b6c1-7136b6dbc222", "indicator--b7700189-73b7-486f-bda8-0f82a7d6c7c5", "indicator--514a6e9b-2898-4e23-87f9-4adcc6e9b474", "indicator--4d7c57be-cc4c-4596-9449-391da78d7393", "indicator--812d93b8-c322-4891-a1bf-206d425f75b5", "indicator--5edd165c-94fb-4526-b31a-8c8af8648196", "indicator--af2f81bb-3812-4cf6-ab3a-20aab6fc3202", "indicator--5fb9da47-9db6-405f-86a4-bbe0af426c5c", "indicator--5f97c3e5-a6f4-4567-8e7c-61516552ab07", "indicator--02412edc-3417-4c41-a52c-032563847a9b", "indicator--46fd26f8-6682-4a04-977f-f90b9d9767af", "indicator--5a41283d-b98f-4f86-b497-9aac10ab2e76", "indicator--3d54fa54-3336-49c0-9253-fc297b83668b", "indicator--55d8aaad-23ba-4688-95a1-c56a9866aacb", "indicator--43b2ae07-c5bf-41de-9fb4-1bcb80827269", "indicator--a72c78b1-69f8-42b7-87a8-12587bd6de83", "indicator--9fb7d65c-4f5e-452f-95d6-71323c9917fd", "indicator--0315371a-0c8c-458a-a6c1-984c51beb614", "indicator--bbebc017-9ff5-4835-818d-715d6b1241b4", "indicator--888eb304-87d3-41d3-8183-5fddc9e5b79a", "indicator--e58974ee-98a8-44d4-8373-963eedecdd53", "indicator--3e7999bc-5183-4707-962e-54a1cad8d656", "indicator--9d807f84-6ed4-418b-98f1-9e1f1d868676", "indicator--de8deade-2e33-4df4-b008-702770c3a4f7", "indicator--975a12af-21c3-4de7-8a6a-5c0e97289b8c", "indicator--a7f9f150-f13a-4776-9686-c9c2cb5d321e", "indicator--9d23d846-3696-43b0-970b-b21c5c8fc491", "indicator--6d3e0881-763e-4b55-be0b-43825faf9b33", "indicator--a58f5d7a-e6a6-4ecd-bbdd-e8c36e3f793c", "indicator--0ae6b827-7a8a-4936-b3b2-99deea7e4d4c", "indicator--f45f5830-35b0-4dec-882f-8932ee4e0501", "indicator--93e81d99-1e74-49a9-a756-5f063c534756", "indicator--d953b272-2c1d-43f0-b0f3-31d413158e39", "indicator--d33d16b6-0a5a-45ef-8d5b-8ba47f1b9516", "indicator--7a71f5f4-e80d-4158-846a-5cebe5917fc0", "indicator--e2c846c4-e5ae-434d-885f-32857fbfc5ef", "indicator--8a2f4001-7d18-481d-9867-c22043eb7069", "indicator--765f560f-9a98-47dd-addd-79c087e66a03", "indicator--b62c5029-a017-42e3-96b8-da88a94a155e", "indicator--3a992df4-0362-43a7-afa0-a0b361467ccf", "indicator--3ea535b8-d610-4172-81af-3ae54f3bfba1", "indicator--7658b8d5-a8a3-4a1e-97b2-58fcf5c7adeb", "indicator--633faee8-1c3f-4e2f-a842-d1623a296867", "indicator--635813f0-7f8a-4e34-a661-84016c78f1f3", "indicator--abb1d41a-89ad-45b9-88f7-2e714cbcd9e7", "indicator--ec03b0da-5ae8-4f70-b5ea-f08d96ad08b9", "indicator--ffb3da8a-f477-4103-a0b4-256a55a2efa3", "indicator--9d91a986-9488-4aad-920f-4530450c408a", "indicator--fb7fb52e-6be9-4fc5-8d4e-6ee7d747fca6", "indicator--d71079bf-c709-4dea-bdde-c796a73fe45c", "indicator--4ee7ba88-727e-4381-9852-6cc7795f3f47", "indicator--dd237cae-783e-41c0-885b-3677044df7e9", "indicator--19665f6b-b413-47b5-87f8-57ba36a11531", "indicator--f77367fa-e3c7-4d77-9832-352befd53d4e", "indicator--7ad75d2d-a1f9-42d4-b20f-8dc240ee6d96", "indicator--6cf84c9b-1420-4874-b8a8-7dbf23ae2800", "indicator--bd857fc6-aed2-4ce2-aa78-263058719520", "indicator--2cb73e9b-b59d-4054-8f35-c84db7eac488", "indicator--bfd53810-56f1-4fab-a005-6d6719ef36cb", "indicator--c78d622a-74fd-4b07-89ed-bd58a988088e", "indicator--cc167fd2-4cb2-4826-88c9-603d97a99fab", "indicator--4e554f0c-54a0-443b-8147-b5bf9cca248d", "indicator--9e05141a-96f6-4f7a-80a7-5e979f63e3c4", "indicator--29036108-7398-4948-8b94-11872effca6c", "indicator--c9c5f868-a729-4645-a542-ec842cfed16b", "indicator--233d4bd2-71cc-4132-9be0-47e2bd4df2e8", "indicator--89936b46-7834-4566-9df7-a9d4c695db78", "indicator--10046ec2-556d-4f12-b856-63b039924002", "indicator--b198e0e9-1733-4032-a8ad-d9ba1cec68f2", "indicator--7e0f58dc-dc72-47a7-ac73-4922672dd722", "indicator--caddef24-1447-4a3b-90df-a182f0f67734", "indicator--b5281f1e-2d30-4644-b9ee-55d0f62df58f", "indicator--24447245-b15e-419b-a08a-c81070f1f2b2", "indicator--23820242-aedf-40b6-ab8e-a6a46d789273", "indicator--5a9ecc82-0f2a-4ad8-b243-0681d1e3cf53", "indicator--4ddc0241-9db3-4dc1-9031-dacf3ff76096", "indicator--7c2702b8-cf67-4346-b520-05c20f24734b", "indicator--d5efb891-ca37-438d-be19-d10da51483f8", "indicator--16ff061c-4b72-401d-8d0c-28f636fe9c8c", "indicator--34c98b74-f96b-4f1c-9aa8-e3fa5a17f2e9", "indicator--2dec25c8-e918-4ec5-aca5-295586bc8803", "indicator--fb485908-d878-4d62-a80c-096448f8c295", "indicator--83b74a39-906c-4130-a000-1b6d63a1b389", "indicator--ea35d243-28c4-4951-a84e-bc96520d2ba4", "indicator--85cfd651-3a5f-4d95-86e6-dda483fad9cc", "indicator--8261ee07-64f5-488b-94ff-bc0fac64e4e2", "indicator--9699158b-7327-4cf1-9c34-8520a045c576", "indicator--2f19dee0-4552-4cb2-815c-fc708ff7b536", "indicator--d71d7d10-03e2-482d-9c89-971511b16086", "indicator--6c25d9c8-68a1-43a2-882f-b374a7609c05", "indicator--d65efaf1-0e82-4061-b137-d5517a6e36e8", "indicator--8e64fe52-ea67-40b9-bc15-aa48a127019f", "indicator--25e65bdd-9385-4aa1-b2e4-aed584fbe9ef", "indicator--dd5ad79a-2a91-4e61-9dc9-1a4d7dafb953", "indicator--db04415c-a053-41b3-bd63-a26e39ecff7a", "indicator--de622ed4-a9af-4f76-a425-e23fb5ffff84", "indicator--d0851475-d087-4056-8fcb-281932715494", "indicator--ac23d9e4-d39b-45bb-909b-3ab7e86e63fe", "indicator--37aa0fa9-c9ff-4f7d-81ec-dbd46c555284", "indicator--495e6ca9-932c-4c31-8b5b-64dc869b9ff1", "indicator--c915e47b-22bf-4827-a564-2b9ebeca07fb", "indicator--5426d379-9918-4099-9f3a-a6717abd31ec", "indicator--e304616f-b3b7-4dbb-bfa3-0cd173c472f6", "indicator--7f22b1f0-b4b5-4214-a9d9-c9b987ce7374", "indicator--9474afc0-6eb1-461f-a671-b36db47af4f3", "indicator--258344c7-1b56-4a7d-b9ec-90cc406cb861", "indicator--9b4ddc65-4509-4244-94b7-f8dd73f56f7a", "indicator--d7df9e4e-efe9-45ac-98c4-3f25873d53bf", "indicator--2388a590-0983-4cf6-8032-53a5269c2de0", "indicator--064c53c6-dc63-4203-a047-d83020937a53", "indicator--7199f66a-1dfc-4350-8916-57bbdd52636f", "indicator--8d101581-9bce-4019-ba29-ef51979b4604", "indicator--c3ea3965-6e4f-43c8-bd2a-84502107b20e", "indicator--3565f9f0-ca7a-4b68-9ed5-eb2a3b6a494e", "indicator--974ca006-fdb2-4c3f-90e3-f97ce1cdc470", "indicator--65caa80f-50d5-4607-bb9f-d7e7d69f3c99", "indicator--8d2571f3-0c93-4c11-8fdd-a8dbbe67607c", "indicator--6204a4de-83f4-454f-a015-441cad215e8d", "indicator--2b181f0c-4722-486f-94f9-f0e53e401b38", "indicator--90514f64-627e-406e-b8ea-1c5517f6ec92", "indicator--9b28fbdb-3408-4418-9a73-ec29863bd4a9", "indicator--f588de98-7d65-49c0-bd3b-7248bd84eeef", "indicator--73c4a877-7498-4595-a1de-ed816b39f1fe", "indicator--ddea3f4e-fbba-4ef1-8f91-6a2dd64dc84f", "indicator--76e16dea-a7bd-435e-8981-f8116fe479fc", "indicator--2220138c-f9eb-45ba-85ca-965336070109", "indicator--6d7ea662-c56b-41df-a715-6e77820ed32b", "indicator--82227096-2340-4a7a-aeac-812b7038e786", "indicator--de3f0c00-b61f-46ca-b3c2-a11fce6d4c46", "indicator--6ecaf4ad-ecf7-4fbe-9950-68ca2bc9f9f5", "indicator--6ce504f9-25d7-41da-b8f6-30d44e5fbbfe", "indicator--9b399478-6534-4349-8fad-8f3fffa34c6b", "indicator--ffaa9164-7291-4ce7-a676-c596b9187b42", "indicator--fec39e5b-190f-4541-9528-b7ffeb56a2f4", "indicator--0ced610d-8a5c-46fd-b335-61f68b7519ec", "indicator--261aeb3c-21d6-45d8-b263-2829735271c8", "indicator--bce7addc-2f60-4eb7-87bc-6b70d67e14ce", "indicator--d23115c9-f510-42d8-b8d9-39a17328db2f", "indicator--e6289f90-b438-485c-a5ca-d876ed7d2a6e", "indicator--639bbbb7-39ec-4f76-a9cb-e0d8dec5812f", "indicator--8951f7ff-850d-429f-9d0b-001a386fa63a", "indicator--b89e2aca-cc3a-4b13-9bee-fd8608bab310", "indicator--3b7eaba6-8b7f-47f8-aac8-86c34be248a1", "indicator--d0f172ed-a5d0-47ee-b131-4169e705bc85", "indicator--c5dc2caa-8389-4eb5-9be9-ec63f13bfd94", "indicator--5aa7204f-1357-4993-843c-b4e0034e2b50", "indicator--06bcb1d6-4bc6-4351-bdd2-156863fc59ab", "indicator--25c4d662-7e07-4f95-95a5-ef161ef81b5f", "indicator--683bf9f3-a5b9-4bf1-8ada-c6383e86bda9", "indicator--26884f3d-19cc-4180-b835-0e1b539a9662", "indicator--90fac826-1994-40d6-85d5-a7a33e964f97", "indicator--465838fa-7ab8-4cdd-91c4-74b723726d38", "indicator--27045105-3f54-49a1-b893-4dffcb82c5f8", "indicator--534cd640-0154-4d06-8fd4-c2364db5a9e6", "indicator--e5e094d1-56a6-49b6-84bb-456dfdfc3ecb", "indicator--07e8b819-ff9e-4bd1-be1d-b4af60792fcb", "indicator--d33a1c8b-2ff6-480f-8b0e-f8272c52a4f5", "indicator--193fe15b-ecc9-4b9a-908b-4d765d8e0898", "indicator--25c606e9-a424-45e2-8db1-1247c7c22169", "indicator--afb73f5d-ce50-4c54-9f5a-44a2374b7529", "indicator--3c883710-6a34-4f78-9343-8bfcc5d8576a", "indicator--97f1c1e0-bda0-4ce2-9cc8-397664c34e80", "indicator--7866df98-49e3-49a7-ad28-13b946b12e6b", "indicator--c2e37de1-4df0-4ec4-8e5f-4dc15e9d455f", "indicator--959c5397-241b-4963-82fe-23a7ca05f5bf", "indicator--ccf59c3d-3d8c-4885-971c-2930ac891dc3", "indicator--356a6851-6d6d-4024-a1f6-afad4284aeac", "indicator--55ac3767-71df-4aaf-9339-2dc058523d8b", "indicator--1b958522-4cc1-47ee-abe1-0877bbfb9ac6", "indicator--1fc41ea8-77b2-4b72-bf75-cf174249eaf3", "indicator--b879fde0-087a-4a64-9c13-7c1f48bb5c70", "indicator--5b638a62-22d7-4a61-9213-a968e42e979a", "indicator--48c41872-6c1b-4dce-9378-56b32bea4a79", "indicator--46f6730a-f00c-4537-b6a0-1be23391b3d1", "indicator--446fa394-85db-4555-9f48-93a374e6f75f", "indicator--943b6031-854a-4068-9de0-d13db08a4484", "indicator--e21b7f67-721c-417d-b4e6-efa0bac7e54d", "indicator--ea583bf2-b00e-4e5b-92bf-18c8a06c7946", "indicator--e49c0046-c4dc-4c92-80e5-ba9475de4eeb", "indicator--68726f79-686f-4a01-9c0d-6e7f85ad3824", "indicator--be4383d2-c560-4d05-a136-9693dd41b5e7", "indicator--e3004fe3-db73-43f3-978f-025b03c20146", "indicator--386a7851-823b-4292-901e-12a8f3095b74", "indicator--e5061127-dcb3-4a39-9ca1-5a0df325e2ab", "indicator--285f6340-3752-4e97-83cd-815b9b312749", "indicator--b6a72ecf-a66f-45fd-8a47-0bd69b5ccb3b", "indicator--2b5cb2f4-8e34-4284-9eae-b7d785375808", "indicator--4cd2d0fb-c317-4776-a078-a039ffcc5324", "indicator--a48c5540-4f25-48de-9d23-0a8fc8f935a6", "indicator--56d838fb-b9b5-4c4a-8903-64f5ec9a0cf8", "indicator--b984fef0-0448-4e95-b40a-8b91e9fdd5e0", "indicator--69743aa7-5740-481d-8836-df49a99c3530", "indicator--c4d4bf4a-9158-4ce8-8222-70f23118bb53", "indicator--16352f6c-4105-4936-990f-a91f7625168a", "indicator--862b95cd-4b6b-46a2-b530-4eec37d7ab45", "indicator--ae24db47-2391-41e7-b00f-d815c743168f", "indicator--2b9c00d9-1bad-42b2-bb32-13c059a0bd08", "indicator--f6b86f28-06d5-4681-99cc-863695a6fab1", "indicator--aa8aaad7-ed4e-4e0f-8bb7-d72d410c9533", "indicator--89af576e-3581-47d5-b9b7-aa06f1a932b5", "indicator--6839f55e-f1ee-4647-a18e-6968fb67f9a7", "indicator--de168d7b-f6ae-4270-b1e8-6bc496aba292", "indicator--32628260-4620-41eb-ae6f-7b3e7a13a3ae", "indicator--a7a7258b-f0d0-4599-8a51-65ce0192b05d", "indicator--d63896d7-7fdd-43ff-a350-2645eb619d36", "indicator--4b534e41-a827-4888-a22b-be7c9af7c84d", "indicator--3dd99fb5-d00a-4ace-9e1a-a28162b7ed3b", "indicator--627bf3c8-5fd4-4f98-89a8-2c2468fd0a83", "indicator--56863f9f-d605-47ca-b9db-49ded1817905", "indicator--602830b1-a2b9-43f4-9ccb-159382a24610", "indicator--9a5781c2-3432-41d9-8b7a-89be42e98d3d", "indicator--341530c0-e4aa-45e0-8eac-61215b6c5d9e", "indicator--4a1de8d5-d75d-4d5d-a409-c1c6c71dc7db", "indicator--b70ea9eb-a103-4b4c-bf0b-de3a09687927", "indicator--c2561a92-1db1-4c19-bfca-871d1b0b0220", "indicator--d622bb31-44c3-4b3d-8952-d932b828859a", "indicator--3683662a-6a76-47cc-81b8-f159bb26fa05", "indicator--e197046e-ed04-4586-bca0-8793efde2bfc", "indicator--dd8ab4a0-aa2d-4f00-bf21-30ceebce8557", "indicator--0405e1f2-b846-495e-8b53-898a73982881", "indicator--d698a7a3-ec1c-4017-b704-f7aaf47781b7", "indicator--64ac9e02-aab1-4aa9-a9bd-6c0e3ae9ccdc", "indicator--472f13b7-683a-42a6-9a33-0e0f520df3fb", "indicator--70dd276f-e1a2-4886-aef3-0a27b4d1e2e7", "indicator--f06d6b0b-4b0b-4fff-842a-55373d2dea83", "indicator--1a4a2f23-c7a8-49b6-8b9c-b186adff1a92", "indicator--38b1126b-a40b-4904-a1ce-6ec4358b6946", "indicator--3acdd25d-080a-4987-8374-406c9cdd9547", "indicator--83974f9a-06a3-42c2-89de-29c92811711f", "indicator--e4c00f0c-c667-4048-8180-dae981aa4757", "indicator--d398e70a-9978-48de-a8e6-1962a93c5f57", "indicator--f512d694-381b-4369-95d8-024dde04ef52", "indicator--5f0c1160-34b5-4d18-a10d-34333debfdaa", "indicator--1476697b-3e59-4df2-8000-7a5a3da723eb", "indicator--940386fc-232e-44c4-87d8-288535cb6aea", "indicator--e920e795-26c6-4828-87ff-5dd9c94d0465", "indicator--ba983d20-6cf9-4f98-a51e-b2cf4081a256", "indicator--f5afc956-3141-4be3-9a1c-4127e4b64105", "indicator--6f0fe1b9-627f-49f9-b7be-7bb2bf64b49d", "indicator--e165964a-e372-4540-847b-0fad533d1e01", "indicator--305e356b-9a72-4a24-839f-93bf87c07792", "indicator--eca0e17e-e07c-4d3a-9a5d-d65e15e1ea0e", "indicator--ed356805-238a-4ff6-ad46-24d3fe1d007b", "indicator--89547c0f-aff0-4606-ab82-28ad92cd5406", "indicator--1643e33d-54cb-4e08-947c-84a99eb969d0", "indicator--362d9bb1-b59b-4e8b-95ec-5b1c1c80a688", "indicator--8aea81b6-cd0b-4550-9594-ad6ecbde2ae0", "indicator--bf586d02-14af-4e46-a329-3890b6fc5594", "indicator--4da64a52-24ce-4424-a640-16af676c097b", "indicator--8538c566-f149-4aad-83bf-212892b93bb6", "indicator--736882c3-4e40-43a1-9708-bb3928429916", "indicator--782764f5-20bb-442f-b130-99f9ed2448af", "indicator--c508ec6c-8e61-4ac0-8c36-08963d412843", "indicator--ed875142-5f03-4427-8bcd-387a90302dd6", "indicator--6fda7e35-b32b-447e-a8db-016d63423903", "indicator--ecdcf468-5b69-411d-83ee-ec58c4228ea8", "indicator--72affa20-a5e9-479b-8d02-c0858455d438", "indicator--c2a41b6f-a08a-405e-a01b-ab701cb79a76", "indicator--6af0df57-a216-4071-9fc8-1b5ec28856bc", "indicator--92c1aa85-220d-49ec-b5a3-c529c110068a", "indicator--ae421a09-bcb8-4a44-b5ff-1c32eeb7e281", "indicator--39815231-73d4-46fe-ab17-4391cf56303b", "indicator--a9a195ba-1dd4-4f78-9994-6265fe5a3ef8", "indicator--c8f0d7a1-7ab4-4251-b294-86b3df92a8c4", "indicator--6546f093-480f-4502-837d-dcc9b10da819", "indicator--d43534b1-aefc-499b-ae92-e0e9ec33bd45", "indicator--8d3dc3fa-632d-4777-a734-7f33fcaac31f", "indicator--f3817211-c6ac-4ec5-b90c-1d01f906fd75", "indicator--b647b724-eb59-4fb5-8815-d0fbedb7adb9", "indicator--b91b4d89-c147-42f0-8f28-5d312f510dfe", "indicator--7d0d6e61-98eb-4054-a452-6c04e5dcac27", "indicator--12bddab4-1dc8-446c-81fd-e65f5068c2ba", "indicator--a8c6228a-b562-49b0-b1c8-74874c1c7e7a", "indicator--3584dac2-3fd5-4d97-9fb6-7b15855a3ddb", "indicator--89ed240a-6fe8-4658-8087-b4996ae23e0c", "indicator--e05bfae5-356a-4b62-8855-c8ce6ca8de3b", "indicator--581d85eb-84bb-45de-9808-9ec9496d0bab", "indicator--e86fa439-4d47-4f84-87f3-021174bd84f6", "indicator--589f6839-21b9-4227-bcc3-5e351cb6d2bc", "indicator--6d7aded8-8fad-4b19-a9ee-751f3c5c081c", "indicator--867b8f25-c7d0-4525-9d8e-7f26ab4f43ee", "indicator--e13e3d8a-6321-4913-bd57-afcc6f962232", "indicator--6ce9bf9c-8d9f-481f-9b46-78ac6e9d4bde", "indicator--834ae1c8-6925-4659-b544-78a1ee6975f0", "indicator--3284451f-f6c5-4d02-8589-6962d88f5951", "indicator--cedd7181-b0a4-4bee-bea2-b4cd48522287", "indicator--b08dab90-2c0e-48bc-885d-5e2615dc171f", "indicator--82cedbb0-a797-4f76-8eb5-879441d403ed", "indicator--ffb47b53-b226-48a5-b059-631f756fb08f", "indicator--f134e95b-3707-4a4b-9fa9-1caf08a1cc02", "indicator--d31b1e16-bc99-4b6b-a472-ea9a75d585b5", "indicator--d313cbf2-d51c-4155-8502-013192bb37cb", "indicator--cea36509-6602-47fc-91ab-2f7edf09230f", "indicator--ef69bb95-0c2f-4782-8b5f-de48bfd800ac", "indicator--700c4a06-37e4-4a95-b9f6-1e04ee9d2c40", "indicator--06c8350b-9b97-49c1-992e-66f6ab30438a", "indicator--96d8f613-1e8c-4524-bb31-ab717e8e3d7a", "indicator--f250fdbc-352b-4e38-9126-42daa01db509", "indicator--f9437df0-61f9-47ed-907e-d47ef830844a", "indicator--0b127fb9-c874-4c16-b314-ec7e5da956a4", "indicator--787ca025-3a95-4f59-b19c-4cb11a011112", "indicator--81961dd4-da57-46f5-8308-0e407d9e223b", "indicator--4a39c4a9-9294-4ee6-8881-2c70f2730e13", "indicator--8b4bdee1-441c-4e94-8e7a-72b4f13d905a", "indicator--455bb0d9-77d8-487c-8ec6-20376b2a2652", "indicator--62c3f94b-c7ba-4fd1-86f2-227e29047162", "indicator--1980fd1e-eb92-4496-8eec-7a7302fa35b7", "indicator--b597d51a-be53-4da1-aa88-45a986b4aef8", "indicator--6f40eb3b-c25a-4c49-bf8a-58a3c97b6521", "indicator--85ea5a77-60dd-487c-a31d-242e002285fb", "indicator--7dc9257d-6923-4044-8631-821717e3bb0b", "indicator--714e1f1d-da0c-41dd-9f12-5ecf39b39855", "indicator--a0bf3fad-a5c9-4804-8305-fe411297813f", "indicator--b1bd6360-3c5d-41bf-aed5-2079a5faedc5", "indicator--41528975-848c-4d29-9220-fabf1af4ab37", "indicator--77115ba4-27a0-4fb1-802e-c6daedfa3307", "indicator--2457fa92-fcef-40d9-853a-bb10378052a1", "indicator--f0eb2c7e-82a2-45dd-8ec5-75cfefc97395", "indicator--f051e922-7490-4ef0-bee0-69e39b1ed929", "indicator--29bac3b4-423a-4281-8fd6-1330c7f3e545", "indicator--c17956ae-8177-4b63-87b4-2421fac05dee", "indicator--5cee465a-f65d-4449-b75d-01a1086f8b2f", "indicator--a964936b-2ee8-4bfa-b0b9-2c8f5e8b3283", "indicator--c5a80480-235f-40f9-86e4-6dc5852da291", "indicator--e302509a-caef-447f-9ea3-92bce3455c2b", "indicator--68381768-1c35-4cc5-9040-ac46cfbb51a8", "indicator--4360c799-abb5-49ec-b03a-b5db257541e8", "indicator--a07e055b-143d-4dd1-aee1-a210e0ff944b", "indicator--fe271b4b-bcd1-43aa-9e50-1426020a1d94", "indicator--e6983f6b-263d-4cf8-addf-1ded55484bab", "indicator--e22ea8fa-fb07-4b03-9033-db16c14cf0e4", "indicator--1c619c11-1b59-4f8e-80f5-23af1fd82ede", "indicator--59a89366-1ee1-45b7-9fd3-089eecb9b40f", "indicator--50be187d-9fc1-45e5-9a3f-04cd18c670f5", "indicator--654eb127-ec16-43f1-b2e7-ac69b37d23f2", "indicator--1a8f4969-722c-4654-bad9-a1c35fadbc60", "indicator--4091f221-481b-4512-8a8b-80ba0bdbe308", "indicator--5fab2fc7-17f9-4334-bd9f-bd5b27963c23", "indicator--00334a95-1274-42ee-83f2-71489f00f282", "indicator--3d67c511-c5f5-4fa9-a5b6-8feababb5fa0", "indicator--38fbebb7-680e-42c0-adb2-039be989472c", "indicator--1258cfcc-469d-4577-85ad-d9f10f37286d", "indicator--59079115-fb35-4890-8022-7525ab594f12", "indicator--f94021bd-3b7d-4a7a-a6cb-24763565a785", "indicator--b7f1ac87-b20f-4a6c-864d-77900b96fd70", "indicator--4b3c1c2c-3a4d-4dac-982b-2f1f3110a21c", "indicator--34411320-1837-4172-85f0-1a5f4d3d637d", "indicator--09356314-47cc-4ab0-9d0f-24f1e2f5ec5f", "indicator--0dc46775-0eb8-4b59-8a16-155a7f83bc6a", "indicator--aac75103-1c69-47a9-87a9-98cab9e60d6c", "indicator--c12c5f1b-ef3c-4204-bd2f-220d67d4b101", "indicator--d1639317-c1cf-4ee8-810b-69dd9639fb51", "indicator--98437af3-9bef-4127-86fd-f42bbea7e11f", "indicator--91ba1937-8878-4340-9ad4-ce082eb3fb12", "indicator--5ec2e9d6-7341-4930-9b9b-b000757d40c5", "indicator--ebdc29d8-a2c8-4a78-9668-9e964a5aefd3", "indicator--1bdecdd1-7783-4124-8ac8-6cea88c8c656", "indicator--c167e132-3bbf-47c0-998c-83e14afccb0f", "indicator--0db1e6b4-b26d-49f6-a431-4bc0bb22dfeb", "indicator--98e85c73-a165-4d38-acf5-862448e9dea6", "indicator--625ead34-4394-4817-b9c0-287990501975", "indicator--3151ca1b-bebb-4084-aebb-201d741ec710", "indicator--1c72db86-2cf7-448f-9a84-e3edc3e99c54", "indicator--75ab9ec8-b1a7-4761-ba08-d2a607f0bc01", "indicator--e00ccc63-664a-4a77-878a-a87911d77355", "indicator--0ea35f79-d59b-4316-acfe-db571f175e54", "indicator--22da2a56-9109-4abd-bf36-19273aded3d3", "indicator--886ae8b8-62dd-41d1-ae14-73923082ff30", "indicator--b04a661b-6e60-49f0-9a69-cd3dd95c2fee", "indicator--76803637-6cef-4ed5-9b5d-3aad5cec3b4c", "indicator--5b22c2c0-96ca-4edc-8286-89445f107046", "indicator--4f7a0930-3ac3-4b5f-9fc6-974497c1e2d8", "indicator--743ed5ce-9ccb-47d3-9cab-2316dc1f34b3", "indicator--a3a4e984-0334-4742-bce6-7e7c4884a7c7", "indicator--c892d35a-baa2-47bc-ada8-5e7354dbb11d", "indicator--1411f784-5a49-47d2-b4b7-05f7b3e806db", "indicator--e516ac72-7bb3-4576-a098-8a741d850758", "indicator--1dda1754-7639-4471-8671-6e11f243c05d", "indicator--a3ddcb5d-4dd0-40b9-91c6-e0d1f030347f", "indicator--ecf2eb79-f284-4b5c-a2c0-5541075e6a3b", "indicator--6884e31d-6f98-4913-b51c-7d8ed9d5a905", "indicator--179ef1e6-f7e0-4732-ae37-5f40577b2c53", "indicator--7b96df02-b4b3-4a0f-b39f-fc15af1981a3", "indicator--b4f0014a-ec44-46c4-8a33-0485a3267544", "indicator--a61e3f6f-7897-43d3-940b-72b5b546b118", "indicator--6880e8c7-9e25-4d78-b113-235aac3be52a", "indicator--47bf4566-561f-4b80-a9da-c15060e1e5f5", "indicator--d9841c34-2bfa-44ff-a114-58e0af76f071", "indicator--faa67c94-b744-4f12-9053-365f393ea7e1", "indicator--e9a05017-6e32-4b26-83d9-894284248d01", "indicator--d4fad7e1-41d8-4a7b-920f-8ea875da966c", "indicator--e28b237b-655e-42fe-a4b9-135048675cdf", "indicator--27f73235-1fa1-45cd-bd1b-631b8f42e453", "indicator--84ce0ee2-009e-4430-a78d-b5757e2e41c3", "indicator--185de750-7c61-448d-a12c-771138654b78", "indicator--6ee5b64e-7ebb-4e92-b303-7e84407b397a", "indicator--82f9dcb5-6356-4c5a-ad2b-4dd3f0e7e1eb", "indicator--8c3370e8-6154-440b-9edc-c351d3e7cff9", "indicator--845bb043-c991-45bd-a51a-24295744356c", "indicator--4d772e8a-9a71-4792-aa38-e126464fdc5e", "indicator--c9cd4c3d-bd55-46ae-9a44-cb19cbd5d07c", "indicator--962a92c4-9278-43bd-965e-8900ea9313e2", "indicator--dabe5023-67a4-42cd-a508-1201b71f6934", "indicator--76ebabb3-cb0d-4183-8bcc-a70988020cb0", "indicator--2a8399de-c8e1-48da-9c5b-20d378644f2e", "indicator--7105a69f-a68d-45f6-abb7-28d4dcc1fff2", "indicator--1e7e125f-be5f-4009-b26c-4170495686f3", "indicator--6f744721-5d81-4724-ba6e-c760a9fff08c", "indicator--6229f598-4218-4619-9981-dde82909716e", "indicator--caf75011-e8dd-4948-a591-236f2061c67d", "indicator--545b47ed-79cb-402b-9a24-c34f57516692", "indicator--5e4bd9b6-b4ba-48e1-8c1a-7e8361ad453f", "indicator--bb4017e6-c133-4621-bc8a-3190e8303ffd", "indicator--dbc63b39-776f-4f19-abcd-6b0e44371601", "indicator--8ff782c0-dd52-4699-b4a1-7d724b258cbf", "indicator--ef531d19-e526-4cec-a856-2be9f069d1c6", "indicator--f0e62aac-22be-41de-b3d7-702362097bd8", "indicator--e9cc7251-a7d2-4397-9fb5-66b050f7aaa2", "indicator--53e08a6a-9596-434d-a4ca-02e3a4ef39ed", "indicator--fb7e1a3a-7e48-4755-935d-d5443a99661c", "indicator--18ff41af-58d1-4d6f-8e05-1804deaac049", "indicator--5552967f-02aa-40ee-9a35-73f1a8d7004b", "indicator--aa0c82e5-eb44-485e-990c-35966f5ce2e8", "indicator--b4039722-ede8-4708-b3ed-0431c21f0e61", "indicator--26056ca4-e6f2-49ab-a8f3-d07fb1220e96", "indicator--34efc34e-a35e-43d6-bf28-87cbeca610bb", "indicator--df321744-6806-499b-989f-a17ad6221727", "indicator--d079c6da-8b96-4a9e-92bb-34c57d4284e2", "indicator--0142a2ff-4bc6-4eab-9441-ab123648d9d6", "indicator--5f1b8c28-cb20-438e-beab-9edb277fdf2b", "indicator--edec786e-e012-47b9-8d76-83225c37f1d6", "indicator--1467bc37-06ad-4015-96fe-d7809fb1f267", "indicator--0a916451-eb49-4220-95d5-9092dbe07c1f", "indicator--15f9f591-4c8b-4cfc-9edf-c497662e7ba5", "indicator--4782e5be-e649-448d-baac-a8840db64ee9", "indicator--76c8cdef-fa84-42b7-a084-1f814c8498f0", "indicator--217323b3-d940-4d02-9d3e-24ab1325acd3", "indicator--452e2b3e-b489-4651-bf3c-9c4672b4509d", "indicator--aeacdc3e-b8a7-4c35-9509-da7bc47e720e", "indicator--0198eb78-2cda-489a-9b8a-7669b0232336", "indicator--407ea09e-c279-42c1-98ec-285888871b2f", "indicator--ae9b17c2-3d2b-4607-aad6-3b7340f2ea29", "indicator--791d3d04-2e65-47d5-ba6a-c4ef9caa27db", "indicator--ac3493d1-6f4f-444c-9f98-2fe83d88f95a", "indicator--418a4068-98b8-4341-ac6c-425d0a3f1d49", "indicator--1ad458dd-6c92-43cd-b9cd-b3a54798c4db", "indicator--174f2651-ba57-4ef2-ae92-7159f29f9ebf", "indicator--2a663938-42a2-47f9-b989-993a7478ffd0", "indicator--222927ac-58e9-4ddc-9cbe-358b55af635b", "indicator--227d5810-f1b8-43e4-915e-ff77686aee08", "indicator--9eada764-aa18-45cd-8c31-27471f090f7e", "indicator--769b9c0d-f3fe-4843-b8de-1948aaf065e1", "indicator--02d30476-4e40-4132-884f-72324acf0eeb", "indicator--e32004c6-9495-4cb1-a5f8-3563b5eff164", "indicator--5ef1a561-2d1a-44e2-97ab-61091a1c47b2", "indicator--a42232b1-fc1b-4122-8d56-c67b8ac1c85b", "indicator--e8a8ef30-e7ac-4dce-a976-ac1e8c4eb982", "indicator--7e12569e-2887-4795-800e-7025f23a7415", "indicator--064e3211-350b-4b9e-bc94-69639656ecb3", "indicator--930f9c03-89bf-4149-b8ec-29c66804921e", "indicator--c1caa969-6e18-4200-aaf4-77807d112cc7", "indicator--655264a7-d666-403c-89de-60ce166b80b5", "indicator--e066d5e6-e7de-47e2-8f65-063653ea2bf1", "indicator--fe50b5f6-c08b-4e22-98d4-8c9828292b6e", "indicator--6f3f4419-2ae5-4c81-b226-1d2f91fab215", "indicator--bd9e20aa-c2eb-4572-9fc7-4ce6d05e5471", "indicator--9b3996d0-1aab-4f95-8397-f7865f8016b0", "indicator--fe276b0b-85f1-4762-89d8-7310a588f2d6", "indicator--6ca78d09-652f-4dd6-81e9-d6c39d93daa3", "indicator--bac70d75-dae0-47ee-88d8-881eb7427889", "indicator--7bbb57d7-2351-4366-bce7-12726fab1cef", "indicator--9370734d-febb-41c1-9819-4ab19e188173", "indicator--407cb9f2-cbb6-492b-bbfe-5308e5674a30", "indicator--9140bcff-30dc-4daf-a2c6-2bd51c1f2e1f", "indicator--d5e979b6-811e-4387-80c0-09faf8b572be", "indicator--9767ceaa-4c29-490f-a015-e04e24abe335", "indicator--4bbc9669-e501-4dfb-9cf7-b7456931abc4", "indicator--c92c99a3-55b2-4182-b9bf-0f848737afb6", "indicator--1d166ff1-d180-4cae-848c-990780c14382", "indicator--953397df-ea59-4476-8ea3-289251900e2b", "indicator--3cc226b7-8526-4312-a52f-3a0e00d5549f", "indicator--d7a621f3-7a69-49de-a30e-5539f6cda1b1", "indicator--3883065e-f806-4572-b1bd-85cf7344f284", "indicator--431824f8-77dd-458a-8d6a-104936511552", "indicator--c38fc15e-343e-45f8-8e82-9649a9f6795e", "indicator--8f4b0886-85ff-4d44-909e-d510c32eb8df", "indicator--f77af372-f242-42a6-ab2f-d878420427a6", "indicator--853ff70a-956d-4c71-b4fa-d5a6499c6dcc", "indicator--fed895eb-bb17-4952-9d1d-a6e0ad6312a3", "indicator--1c3dc26f-0921-4bcc-9b06-54c020ef549b", "indicator--bb7e1808-9a03-4ff1-b4de-2a5bd61558df", "indicator--dee9bbec-45c0-433e-862f-48ce193f2ad1", "indicator--faafdd0c-c26d-4d88-80c4-32b5a52932f6", "indicator--14b15f41-e5f5-41c6-bdbd-7c1c08d5d9b8", "indicator--52f87ba8-4bed-43d7-8f44-cda6d014b851", "indicator--3c01f409-ade5-4e5c-ae08-97c0d4836ac8", "indicator--cfc6a9f7-75cb-42bc-a9a8-6169115e6b25", "indicator--d9aecccf-328d-45f8-9269-f891b0135798", "indicator--9b8afb5c-e3e9-4749-b50f-2c4e81d7904a", "indicator--4bd8628c-e0e5-4040-8fd4-1e295447b761", "indicator--9d2fb08d-a0cb-4655-ab67-7d1209fcb6b7", "indicator--ce82424e-e7ae-4362-af9f-74e9290a50db", "indicator--367152b5-ad9a-4eb4-b7ca-b5b96d4c5098", "indicator--a38d3c32-3c13-4335-ad67-b63384761e65", "indicator--37e7a73c-66ec-4b74-8def-f355b9e3d418", "indicator--cd381faf-fc6a-4366-b5fc-7facacf2ed17", "indicator--21454653-011d-4c9e-a2c4-65eac0f643bc", "indicator--33756fb8-1076-4ec9-ac41-40a30eedcb49", "indicator--773f1c3f-22b4-4313-880a-ffb48fa674a0", "indicator--c3ed785a-7a21-4de0-9624-65b2dc477092", "indicator--3e77cf3a-9618-48e3-b043-fb2fc16a46a1", "indicator--6fcc3ae9-067a-41af-91dc-28655da10750", "indicator--918847e9-7d9c-4fe4-9781-d3a34aa110d3", "indicator--2ba102a8-f9ca-4080-ad66-142bdb0386b7", "indicator--a98ed1ef-18f6-4c46-bfea-a7e62b4b9cda", "indicator--6f5622e4-496e-473c-aaae-a8afc94ae1dc", "indicator--6469a33e-508c-4024-9ac3-643055039596", "indicator--a1073f97-eab2-47fd-99e7-abff31c7d604", "indicator--1139d31e-64d8-473e-835f-0d9db44cbfd2", "indicator--7a8d6a0d-2995-40b9-a8c4-ea16d8d2c2f5", "indicator--3563c9a1-26f0-4d4d-ab83-72d0a0d5bf41", "indicator--51a2d2a6-b3e4-4fc4-ae0d-27148046abf0", "indicator--e4ed43c5-72b3-45ef-8de0-42464269b3be", "indicator--6b36bb8f-0b4b-4a03-b77a-d3e8ec076b71", "indicator--7cc06943-8ab9-4588-97c6-824cb5ab2660", "indicator--d321338d-9923-43d4-997e-f27ac38ddc46", "indicator--e6827b50-e254-42c4-8665-4873b8256d3b", "indicator--6e2bc642-a16f-4ec6-870d-dd7d5d6c374e", "indicator--cb3a2efd-8cf0-476b-a2c3-a3a3509cabac", "indicator--438d27da-5c1e-4669-a5c8-bac018111d36", "indicator--5209bd7d-63ba-4623-b718-d7f71ba5f1f5", "indicator--85971785-d9d7-465c-be7c-18c1d1ab4d7d", "indicator--974d18f5-54d9-4c7b-9d02-7d56c45b2ae4", "indicator--bebf19e2-7588-4cbf-86c4-89a47292af33", "indicator--b812d059-f0ec-4504-9d24-3c552292ecbe", "indicator--a0988967-3b9e-4584-814b-90bff2c6b0e6", "indicator--cc78c0c9-9e63-467f-9c35-666bc2d52c85", "indicator--720c53a5-450f-4e7c-8f24-98d6bb1de57c", "indicator--4c4064ba-51c5-4576-b61b-95b252dcf613", "indicator--587eb371-a7a2-4bd1-b3a7-1401c3c70e4f", "indicator--e9ab23b1-cc60-43c0-ad37-d219fe5d1c68", "indicator--75335dda-ce07-4397-8916-26a2e4585043", "indicator--e3c9cd5e-aba6-4b66-8925-3c8e7237dcd5", "indicator--e97c2bb5-b23d-40a9-9284-9e21e2c5e6a5", "indicator--f463eded-c64c-4c45-b664-2500053d2587", "indicator--79abb1a5-009e-486c-b7e6-970ffa12f7a8", "indicator--44bf5b61-d2d7-4f85-935a-0a222ea346ce", "indicator--d9671cd9-3bad-471f-80b9-88b4813fbe8e", "indicator--2411e593-3574-4355-a874-d31cc1bbcb53", "indicator--7a45ebf5-f24f-43f5-8109-3e88fca9560b", "indicator--26162a68-71d3-45f7-929e-af0bc01a1612", "indicator--cef63858-f372-4b5e-95a1-8a9ef33ee6e2", "indicator--356b6914-bf00-415a-9b97-bce0f3b7c5a9", "indicator--e9e09c35-6f5d-4bc3-9cc3-5492730a5ef1", "indicator--1435eb17-f329-4f47-a2c0-4db4356dc159", "indicator--4a172dc9-a4f0-4250-9b1e-cc5f2c2b3812", "indicator--0c79e29e-92b0-4d7f-ab91-c9b5491d7e6e", "indicator--f3648383-0599-4bf5-97ff-a593bff72a25", "indicator--bbec3ea7-8728-437a-9286-30b63cbd3565", "indicator--78bee9ce-8498-4bde-911f-7a594af21626", "indicator--ff85f1d9-1d4f-4405-b92a-188da7bb76f0", "indicator--459ca7b9-e149-49b8-87a5-dea179fa6684", "indicator--529bd348-1871-4a0c-822c-0b071f4588cb", "indicator--0abe33cc-8fda-4377-8bff-90363d8edcf7", "indicator--b82ab78f-a461-4ce6-86d3-1c00d433b4da", "indicator--54fd1f02-2c7f-4088-b1ee-f2ac2d800a1b", "indicator--f810949a-907f-4096-a3d8-4d5fa6ff2d71", "indicator--5cc1e1ec-dc26-41bc-ab51-af3def42bb92", "indicator--56dc02cb-568d-458c-96ac-444696aa0f16", "indicator--175777c7-7052-4174-ae31-5bf578cba592", "indicator--3efec0cb-75aa-4a99-a883-d34af3d851bb", "indicator--c3f1506a-1a1e-4e3c-8390-09b6563c17d9", "indicator--98f08acb-30b7-4ca1-bbcd-775f67b73842", "indicator--e844c7c2-838b-428f-b8a6-71c3a5cc803c", "indicator--04967508-2d20-4d6f-9ed6-f23ee0546141", "indicator--bd8fb835-b178-45be-9537-d7b9bc10753a", "indicator--5f763a47-6aa7-42e3-a3c0-633b8d39e86b", "indicator--1ebd7f6b-25c1-4778-90f0-c69533166eec", "indicator--913e6aa6-2bef-461c-9022-3cd124c9e863", "indicator--19cd0b51-a880-4195-accc-cded3cf12526", "indicator--9587b246-492e-4046-959d-5689c37a65e3", "indicator--e0e74cca-ea6d-41ea-8ac8-30c16e1c53ff", "indicator--6ca5b388-7a9b-4532-bf07-ace328bb0494", "indicator--63aa37f9-5bec-4656-8141-a10e841b448d", "indicator--a3734f7e-bee8-4286-9512-6035431d623e", "indicator--7edaeef0-230c-43a3-b700-c3bd21ba8d1a", "indicator--23340f18-7190-436c-a839-9c60afc9d48e", "indicator--9d4e5298-f556-429c-9adc-f1550d182cdf", "indicator--046448cf-459c-4c3f-8b79-377bef6a1560", "indicator--1054c7a4-cac0-4ba2-a554-557b505828ca", "indicator--0656a73a-8a13-4d40-b228-8cc6acf5181c", "indicator--59051ec5-08d1-4c7f-9797-00d50a6dacee", "indicator--93ce703c-91ee-4394-ae83-65b36bf43582", "indicator--68d2916a-8318-489b-8544-65218b049b26", "indicator--a61f331d-906a-4d71-bf4f-f65deb39c986", "indicator--71c5e70f-5bc7-4700-975b-4e4ada3dfd05", "indicator--e4406905-0ceb-49fe-ab06-375bcd6096f5", "indicator--90511ed8-91b4-46af-9fa8-e287449ff7d6", "relationship--0922a381-722d-4c84-9074-6282df11975b", "relationship--a712418d-047d-4ab8-abf2-e6068ceb9e43", "relationship--6fe4bc43-a1ab-45a2-85a6-35571ba29543", "indicator--292745c4-b117-4ae4-b4aa-1fce65cc92de", "indicator--c3838ee5-65d4-483b-b1ca-0edd628d1b53", "indicator--bfb3b724-5641-4cfa-93f9-790665b29e06", "indicator--abc3e690-1fa1-457a-b207-29be27c31e82", "indicator--04036c1e-cc41-43e3-9b2f-06b35c40c7d8", "indicator--18a72ba9-4b31-4c71-b06f-279f0c5c31d8", "indicator--9d789935-b365-41bf-a542-ac635f872af6", "indicator--1ab01201-ec1e-4aee-adfd-e0cb4339a70a", "indicator--5a2bb096-745d-4877-ac20-75679a750c0f", "indicator--82ba1f73-9861-48dc-8eb7-9fb3e4a81d57", "indicator--43487b05-d5f5-4a2a-9041-3dddb8e72bc1", "indicator--c866480b-6427-4fec-898b-06bcd15accd5", "indicator--ca619b15-fe0a-4cf6-bfab-4170cfb7c9ac", "indicator--a60dbefa-ba45-475b-b3ac-53994943cdf6", "indicator--c50b9d5d-6aa2-4153-8346-5a9a5891f5c2", "indicator--71b103fd-c116-4cf8-9458-0098951fd093", "indicator--24c8b955-a9ad-452d-a51e-edbe7915e2de", "indicator--08d40694-0036-4383-bf5f-838a8ddbc359", "indicator--7fdd64ff-70ff-462d-b2ed-a453706c225f", "indicator--6137d0e4-66f3-4fa6-8ffd-def2dcc40ec7", "indicator--82ca1f34-f606-4f35-8100-4137c43a5cad", "indicator--7038e10b-93a9-4899-aba3-e7f80c983d39", "indicator--0b606925-b2bc-4b7c-b986-89c721b0e4d9", "indicator--e010cea6-e866-46fb-9540-130219b59063", "indicator--c010126f-ce02-48a6-a2ba-54b08652b094", "indicator--89a2c413-8ccf-4d18-8d0c-3a59bb217d3e", "indicator--a93da912-eaba-4b24-abf2-cb629f53d00d", "indicator--7554480c-a283-45b2-ac34-9d7cfcefd54f", "indicator--e2d39a42-aa73-4a87-b4a4-8a36a2600a56", "indicator--f55b98e6-4cb3-4afa-abd3-d67e8eb6bfb2", "indicator--92a2b3d9-5e6f-4db0-a13e-7c084b62bf66", "indicator--8b4817f7-8cb2-46c3-b3bf-8ef48f0f579b", "indicator--f9b00cb7-8388-4c8c-bc43-960eaccca11f", "indicator--09068c39-f3d4-4621-ba85-7d7a8ac9168d", "indicator--63208308-2638-4723-900a-4b21bb7d43cc", "indicator--c6b47e12-d5a7-4342-ae1b-2bd4fa3989dc", "indicator--993ceae4-d1e5-4847-a2d2-a9dc225f58cd", "indicator--a998a0a8-66f6-499b-89ae-82c23bba5a43", "indicator--f6c4cdbc-ed35-4acb-9826-e2e4a75b0272", "indicator--ca38dc0f-c933-4c6a-9564-c9eac59ffad1", "indicator--44f2e2af-f05c-4d9a-8737-57c8b89f5676", "indicator--d4e96071-ad9a-4554-be1e-8766ab26e85a", "indicator--226dc58a-afca-44e8-827d-f61ace165e94", "indicator--f045509d-9ff5-41d0-8279-c42d1902bf28", "indicator--3ba09b7c-f6fd-4261-93c6-ba5038356da6", "indicator--ea07bc80-cce9-4d38-9d1a-1621a937e4a9", "indicator--71758599-6cac-4aee-92bc-bcadf36bdf05", "indicator--addbd00f-694c-4b47-afe7-413ece0e8bd7", "indicator--1cfec46c-b6ae-4fc5-a65f-28710f452a77", "indicator--749a1fd0-3280-4639-8c09-43e1caed1df7", "indicator--8950d6dc-f413-4706-8700-c40086a310f9", "indicator--f91d7db5-ff72-410a-b2b3-1193fedb7d6d", "indicator--884c1fff-7f33-40b8-b82f-e2445ecd1081", "indicator--8bb55635-6454-4428-9ec9-e6c6e9f6a557", "indicator--2a6673bd-cadc-4892-a242-7fd84316d5d0", "indicator--12be65a8-cc56-4966-972d-54fb31453044", "indicator--1acbe701-faff-4a7d-9370-79d2c5f9ddd6", "indicator--8c5471c9-a153-46c8-9b9b-d074f7b079d3", "indicator--fccee0b3-4176-4f79-98f2-2e1d43427d99", "indicator--597eee2f-e2af-4de9-b661-530ce078df80", "indicator--f81c9f92-73ac-4d76-8edf-964e1882dda6", "indicator--62f2df3e-f253-458e-9756-43c3b569dca1", "indicator--e77d99c4-a1d4-4576-a702-82ce647cf1b0", "indicator--c50cf1cd-74c6-4283-8a0a-d1ee4dd0fd33", "indicator--c8a9cd4b-af63-492c-b1d9-b549f45a478e", "indicator--732c7059-37a7-44a1-9325-736fabe89749", "indicator--ede21063-3c29-46c0-9d16-ef1b067cb306", "indicator--cce0c1ff-d5bf-4b69-8911-3da91648959c", "indicator--3086a2c8-830f-4fe0-b3cf-96651009e7c0", "indicator--160cde2b-ed91-4f89-bdb8-7963900686e6", "indicator--87397f3e-1c1e-434a-b5e2-fd75e228b985", "indicator--e2066351-2976-491d-902c-6997b16170b6", "indicator--392c9422-abdf-4095-b9c7-29d10bc9ecc9", "indicator--430a15e3-dc39-4a15-9b28-f65d028ad41c", "indicator--3da85161-d919-44de-9da9-855283cf51f5", "indicator--43be0b10-4f1d-446f-9446-c24f54113332", "indicator--39fec5e5-758f-4096-a1b2-a6d7811ec9df", "indicator--7fa11a95-e7f0-4c64-b243-7abfd215a0f3", "indicator--19d67595-813a-4fe9-97dc-0f29570d5a5d", "indicator--d81832b1-dbf5-48b8-81ca-6d64d4dc01d0", "indicator--4512cacc-7cf3-4e7b-965f-3854b9fb56fc", "indicator--538cf9cd-1a19-4241-a65b-617d81ae0d40", "indicator--6640fa72-fdc3-43f3-8cc7-c4331c0ece6a", "indicator--a69c7b5d-42fe-4458-876c-c99184add94e", "indicator--883c17fe-ebd3-41c5-8f76-aa8521529731", "indicator--64fb4034-902f-4ec3-ae2e-f8f3c53c3d64", "indicator--0ce2a940-3e0e-4c3c-8933-4569f5a163db", "indicator--04859c6d-0e13-4c48-9d66-ebdcfda2a6ff", "indicator--64fdf1b3-b139-42c5-860e-fb015c6524bf", "indicator--14015bf1-48e6-456b-b24c-e21473618706", "indicator--853ddbbf-a168-4c5d-8110-e1ef37178cac", "indicator--9642754d-0f7b-49b6-8dd0-e6c4246afc40", "indicator--74130c0b-efa7-41a4-ab2b-0fbd5dcb7903", "indicator--d0ce4c7c-af0d-4406-87a5-2f3ff52d8a94", "indicator--07725529-b1ed-47fc-bc00-4b41e1e4f1b0", "indicator--3fb9c1b1-ffa7-4d2f-be5d-ec999b146c56", "indicator--a603cff6-0233-4f26-afaf-51af4cc5dc4b", "indicator--239aa44e-0ff7-4428-8049-0c437144ddcc", "indicator--49368002-bd69-4763-8c4f-b81f4bfa2671", "indicator--996f25df-d027-4468-bc35-817c8e7efa5d", "indicator--a7381aaf-234e-4340-b1c5-d522dc6a9dd1", "indicator--a16f6b65-da80-4369-bf9b-5c5826663115", "indicator--d14293fd-842d-4b9d-a155-ab3d1558676c", "indicator--247df40f-6475-4b45-a934-2d2289cdb580", "indicator--63b8eb2d-bae4-4c3e-ace9-85de795a272d", "indicator--9e26813f-a659-45d5-9913-5f0de66a56f6", "indicator--b225098a-57df-4e91-96fa-413b7e736137", "indicator--41abc79b-a010-466c-a092-9cd4803d5496", "indicator--ed6cb406-1ade-428e-b67d-ee31b875ec93", "indicator--7b3aad64-724b-46b6-b321-bd4493e672d9", "indicator--c62bd858-d559-4ad3-a71f-ba70e709b9eb", "indicator--f279f191-0436-477d-8dc4-c6458942fc09", "indicator--a5f1f2fa-b53d-433e-b7e8-c6210a62cb5e", "indicator--e9877ecb-b76f-4960-aea2-9ec17136367a", "indicator--87186dc9-69f5-42d7-83f8-299a8b6bdbf2", "indicator--e5f4c642-a7f5-4c23-96a7-f6da5e7ff7e6", "indicator--7786ed93-6773-4a14-a2b8-c2d5ff0f038a", "indicator--782b3049-4bb9-4a53-923d-6b55fc1675c2", "indicator--2129390b-8879-41bc-9753-334f6ee150cd", "indicator--73fca511-931e-4770-8818-17fbcf14c466", "indicator--a34749bf-456e-4ccb-98a9-be591a1f3f4e", "indicator--4f92773f-d75c-49f5-b775-de084beb6033", "indicator--27c15cba-1b69-47d1-aabc-ba60a869b84c", "indicator--359bf9c6-8635-47de-9e4d-85cd7e778419", "indicator--3ece72ad-12fd-40d7-9dfa-53f7be5b4b40", "indicator--cf8af3f9-e614-466e-9854-36c26d8684c9", "indicator--56d637aa-cdac-4b97-996c-1727716f87ab", "indicator--46dfda51-34ab-49b3-806a-ac26eb410bae", "indicator--a1951579-63ab-41ab-95ac-88f25f8f42be", "indicator--f7f813f8-64fb-4287-ad5a-c5dc4166eb49", "indicator--cb69154c-2bba-4b92-9d9f-8a74672dc365", "indicator--ca473c1f-a3b2-485f-b113-b47830cc9aa7", "indicator--c930a163-a3e1-4521-be48-a59b0d33eacc", "indicator--68584ab4-770d-472e-b55f-59dd4abc732b", "indicator--4a6e44ff-7d59-4986-8731-37dd3655ff6e", "indicator--ea7efe28-2290-479f-8465-ac723afe48d6", "indicator--1ea519a6-f270-4a74-819b-85e113d24a0d", "indicator--d384ad35-e787-4271-a54c-feb20ff72b39", "indicator--4fb3cf6f-70cb-48c7-96b1-eff7fdb37d90", "indicator--5e7e1257-8429-40f0-8611-83f4e46d7cd2", "indicator--27b0316f-0285-4cb1-b1f1-6975076ad1bf", "indicator--dac28c61-36f5-4026-b395-1fd74f1c915d", "indicator--84da3f9e-17ab-41d3-b6f1-d5d1a56e1fa7", "indicator--b448f76a-d2b7-4ab1-94f7-885627ed49cf", "indicator--7221bf0d-04fb-4b10-ba7a-dfae3df53d26", "indicator--8a4db2c9-1d0b-43b7-b184-accd3b1f2ee6", "indicator--65e2a70e-9d46-49f5-9823-01edd504767d", "indicator--d92c9c3a-d73a-4473-81cb-a980bf0bf6df", "indicator--7aa44bc7-04bc-4ccd-94cb-a78e607912b3", "indicator--1df18879-5657-43cf-bab5-6efcd3ee5e42", "indicator--79c26ca8-17ec-4139-ba70-af009a16e532", "indicator--3c1ab13f-4952-4f0c-b54b-0d02b4d6a0bd", "indicator--e92d01c7-52db-4cb0-8d2b-a08db399364a", "indicator--6d8cf6ba-8ffb-4bc4-b399-7dc4abadbf4c", "indicator--cbd8a220-beab-40dc-8975-c6531eab8289", "indicator--62d6cfc1-0ed1-481a-a900-1cd986ee3c7b", "indicator--298a3575-595c-4edb-b2ff-e7f5e81bace7", "indicator--fcca383f-cb0d-41cc-9568-cf276a1146a4", "indicator--fcb51111-3b16-47ee-8e7c-d9bdaeb39ab2", "indicator--149d3261-1ab1-4787-b22b-a4655905576f", "indicator--204be8cc-03c9-4aea-898f-022076eaad1e", "indicator--92c1d09a-bb83-4ba9-9f10-1ae7a4b2b39d", "indicator--e223fade-5437-44dd-8062-27dfb91a5c57", "indicator--17ec2fd1-d537-4e07-bb6e-547a8b26fc78", "indicator--8a485ac1-f1cd-417e-a4b2-e40f32bac010", "indicator--58b36f8d-0207-4d36-a4be-bc25bdb7506a", "indicator--4756f5d4-7a18-4ac1-b5e6-0ef4861092ac", "indicator--cdd56330-c6f2-48bc-a8be-af062f01ffd9", "indicator--94ab4250-79d0-4658-9daa-0fc4eb0a2b06", "indicator--dd6f1b3d-af7f-4d6a-893d-075e0c8d4882", "indicator--198c9c90-d87a-4b29-a59b-67ad7272323c", "indicator--aee7f442-d974-43b8-9ad5-f1f4573f64b0", "indicator--15ca5c6d-e631-46c6-80a7-1d793527bbb3", "indicator--d469102d-aaac-456d-bb44-c5c09f14b06d", "indicator--a2621ce7-cf3e-4db2-a9bf-61ed69249a57", "indicator--bc764b89-9573-4252-958e-b57925e10985", "indicator--c70647d1-8fb9-43b5-a0b3-df55dfb1f575", "indicator--da8b7673-132b-4b8a-a704-a30d48785a14", "indicator--acdde07c-0293-439d-a7ed-e6ee301e9f17", "indicator--2a398683-37bd-41c1-ac0a-7781e57dd80a", "indicator--eb06e747-0895-445f-9b66-d048cc06028f", "indicator--2e9a4ca6-102e-4d8f-a2d4-ccdef03e806b", "indicator--b809bf28-4a30-4d2b-95be-1d8829597e87", "indicator--7fe34e44-ef0c-4f75-bafc-31a9229db031", "indicator--b131e142-1cd3-4441-8364-239b01c2182e", "indicator--10e4a388-8454-4ab5-94df-c1cc24339160", "indicator--8c2f09df-de8b-4480-8dc3-aa6f28219b93", "indicator--e32d51d7-082d-4476-9f53-1af2748e1f20", "indicator--103617ba-b29a-4078-a159-23083d833cbb", "indicator--19b9fc1d-a0b8-4653-bf5c-b516062cfe74", "indicator--6d47dcc7-9177-491d-9f8d-8e0018362a04", "indicator--2ee04af6-70de-4478-9bc1-c83ad7d1f65b", "indicator--f940a8e8-a4a3-4356-8115-3d7a7250f0fc", "indicator--444c6ef6-ada7-4bbd-811c-0dea3923769f", "indicator--e2fa0cd0-e1e8-4277-80ce-d5ae6416f73e", "indicator--8853f50e-8ca3-4a39-aab3-2248a5f76ce0", "indicator--39a2334f-24d8-4bed-be8f-3d64045c109d", "indicator--6b5e230f-8e46-4704-adb3-17a1d31ec6b7", "indicator--674fd10c-ff21-496d-8634-39e8df1494c1", "indicator--a1596a80-ab1e-4ab4-974e-3790dbb10e06", "indicator--e7dc61e1-8172-422d-9dc8-bc3da2103c6f", "indicator--90b2ba3d-096a-4ee6-a39a-09b3001c9022", "indicator--c1c6f2b4-3858-4080-a110-73a119199ee7", "indicator--8b993189-276a-4576-8d9e-b0b54574dd9e", "indicator--28a6cb8d-d686-4c7d-9080-0beaa77ac9eb", "indicator--0736127c-b03e-4168-9934-30ddc36a7c2a", "indicator--3eed5a22-f522-4113-8d26-c1a6b51fa2f3", "indicator--7d1fa683-27fd-4c65-8c6b-bc6b070b6484", "indicator--6d9f7fb9-57ce-40c6-bf58-afb33305a86b", "indicator--13aef32b-8e2d-453d-8c46-1d4a9cf4041f", "indicator--2d0c6206-ff85-4095-b633-99467fd6e584", "indicator--b2beeead-a187-4a86-a212-1ae7c5653698", "indicator--aadbbd50-d12f-4daa-9028-d2a1d1698da1", "indicator--99fd6363-3bd4-49c0-83c9-18592ef82e37", "indicator--5326ac5a-4434-4e4b-93d1-0c09615d98d7", "indicator--bf2dd2d0-1826-43f8-83aa-94590617d1ba", "indicator--096ed643-4919-45e8-961a-85fb1a9dc5b2", "indicator--803f4386-9e47-48bc-a966-d53640e2c847", "indicator--eeead983-28a4-473a-bb58-2f1a445e8b70", "indicator--d6e8ffb3-197c-4133-a05a-dc6995f47c47", "indicator--5022fe82-b9a2-49e0-8983-9d9db072d54d", "indicator--5ecb9faa-fa51-42b9-9388-49831fc17208", "indicator--5c24544f-8d5f-444d-a7db-c384614c02ea", "indicator--c902c0ac-7823-4a63-9fb7-75222eb8b749", "indicator--18f902e0-d792-4038-af5c-336d586b281f", "indicator--19a3eba7-8ed0-4e9a-adab-1e77cb1668c1", "indicator--d65080f8-fcfd-4309-b9c7-78ec9ab1e60e", "indicator--705b658f-a89f-4b9e-82c3-fdec716deac6", "indicator--95551685-8fd2-4a65-b49b-37063a1b1226", "indicator--f1fdd565-208a-44cb-8c4d-f1631c9714e9", "indicator--02b2a084-f496-4a50-b5ae-f8f4038a7724", "indicator--c02dcbf8-789f-4eb4-a7b2-0e95829a312d", "indicator--3500be8b-0d38-4c51-a4be-a03fdecb5872", "indicator--380282b0-99d9-48ee-8d5b-c7652f3cd227", "indicator--f429b012-bacb-487c-a9f6-2e92dd09c858", "indicator--dd67ce49-2679-42ac-8c4f-25299fd18983", "indicator--102e6b3f-2f86-4723-bfa9-09fb52442986", "indicator--dc46ee85-2e46-4d49-af79-5e34e5f31d0d", "indicator--f1ec07f8-b0b7-431b-af1b-5d06d80f9383", "indicator--db171d64-3a1b-413a-8d10-02c9504bcac9", "indicator--6577c7a0-a7a5-4646-b630-f44be6a94ac9", "indicator--e90fcbd4-e07b-4830-ae20-51b5c7776580", "indicator--1f710e01-3193-46d4-9b02-32174cc270ca", "indicator--beea47a9-4940-449e-a4e2-24b417037804", "indicator--5b7cc6e6-bfa1-4c4d-bfc3-6a0884a0c6d9", "indicator--2030e076-7d6a-45f2-9571-1af2b85af244", "indicator--4fd1063f-3676-40e2-9671-cfbe58135e8d", "indicator--f5d96a3f-d201-4d2e-8452-fa211b60be72", "indicator--6db9f20c-4d7f-47fb-aae7-133501defef0", "indicator--09718f95-512e-4f11-b28e-33a7d60a90d2", "indicator--c17e1ead-d23f-48a1-a486-ac3cb8f613e6", "indicator--9571f6a3-4769-4d7d-b325-00c000ac53dc", "indicator--afb025fd-e8ef-4998-b18b-5f58e1163698", "indicator--7893b5e5-82ed-4c36-a86b-2bb6d4a90531", "indicator--aaab6dd3-4b11-44d9-b738-48e459bbee70", "indicator--cf6891d5-842c-4f2f-8840-92803349f59e", "indicator--1e915161-4b98-4c18-9c3e-58128d2ae7da", "indicator--473a2205-9cbd-49b8-b2f7-f8442111b7ef", "indicator--9c590188-cdc7-4d5c-8722-708667844dd0", "indicator--8991e880-5d4e-45f9-ac6b-37220ece0e16", "indicator--e99ead2a-8a14-48cb-8e3c-bba38a86039a", "indicator--39dda6bd-a233-4058-9abb-b0b479367558", "indicator--f757dc22-1ba8-4769-b896-20ff4b545046", "indicator--cdbf48e6-4e43-4272-b009-67a9fc9039f2", "indicator--e7bcbd7d-6250-4997-bc4f-e325f858e59d", "indicator--fcd1a7d7-22fe-4b7d-82c3-f6a85b8bcf49", "indicator--9d8c0271-5f1e-4399-a1f0-e5b1340b087e", "indicator--43d96630-016e-4ee3-bec9-3a0179d86f2e", "indicator--131c054f-d4fd-4c8d-b773-f1955c3cc7ea", "indicator--69879ba1-9c46-4611-92ee-1d05a2f8b196", "indicator--16715a11-6698-4e7f-b938-7471720c6c53", "indicator--835394b8-9c16-4fc2-bdf7-2e605a550138", "indicator--465fc953-d42f-44ec-98f3-cf03d4d1095b", "indicator--626d0720-bddf-481d-bb58-a412ee0bda0f", "indicator--7f7e0cf6-0a61-4af9-987c-73f3204ebb58", "indicator--4e77a49a-a543-4906-9b59-ae4212f90a4a", "indicator--b6d45850-450e-4f33-8a88-ca16bd50a608", "indicator--1c81a364-aeb4-4d8e-b4dd-80cbc2075c1b", "indicator--ace82091-c0ed-470b-9a33-aa8991d5f33f", "indicator--4e2843c4-76a8-465c-8cf7-eb9accc5e712", "indicator--55c0369c-f37b-495c-aa0a-30f3259debfe", "indicator--ecc5b062-6b55-427d-9668-a3d7689f2fdd", "indicator--30a031a4-8d8c-40c5-84f4-97624d02c47d", "indicator--4ca7af8a-0119-4f77-8799-db2d1ae2a7f7", "indicator--4d6ba5e3-9904-476e-9126-abd5f4b9739d", "indicator--f5af15b1-075a-4235-84fb-cf8719030f07", "indicator--8c9c0df7-8f92-4a90-91b1-a3def9d06bd9", "indicator--306965bc-d67a-488c-b24c-65df55b68c7b", "indicator--01a19326-8139-417e-a35e-06dfe91a4356", "indicator--a11124df-9178-4f48-91c5-d5b809181e83", "indicator--3424447d-0b58-42ce-a3d8-88b6f3b77290", "indicator--e240009f-30fa-4b77-9b2f-ef1a0e81a4f2", "indicator--4d456880-2014-4731-a8a7-8142a8271b7e", "indicator--9b1ccf8b-87ea-4e74-8527-bb728e3be0e4", "indicator--7f9b2a7f-d0f9-4718-a72e-beaae75c7c11", "indicator--915847a2-8e20-4796-a42e-3aa08ebd8d04", "indicator--70f85517-2383-4ace-9589-a1622e514816", "indicator--56b381b5-7e69-43fd-be92-773d850046d0", "indicator--6adbea04-6a99-457a-acd1-bfeee1235b4f", "indicator--9922c363-a755-469f-8f20-8a682fe8dc3f", "indicator--b1048f1c-9556-4ac6-92c5-1b298ef208ec", "indicator--bc2df9bc-f2f7-4d86-bf19-bfdf52bc3b60", "indicator--7f6b8889-140d-4ea7-92a4-0b505ba6df2c", "indicator--012696f1-e030-4277-a64d-326f9cc5e6c4", "indicator--d507f1e0-9c60-4c9c-8afb-6aa58d5e38c8", "indicator--b64440f8-a9e0-4e97-85b0-47541a232038", "indicator--8d6c9aff-fc87-491a-83a6-7a9da06c6f15", "indicator--d482fe5b-7b43-4c39-a51d-45b005427124", "indicator--dda4e13b-b7e3-4f44-8233-ee0cf78dd504", "indicator--cad0b5e4-cc83-443a-b682-9d8c0334a1b0", "indicator--4832d185-c9fc-407b-bf91-1042c93b60ec", "indicator--6cd110df-435a-4800-aaac-53faf275b652", "indicator--f76a5b1d-5ba7-4ec4-a7cb-774fa48ed84e", "indicator--ca310baa-ea65-476a-a1d6-b236a2eec8de", "indicator--aae393df-d61d-431e-bddf-649f0d35ced8", "indicator--f4bc069c-9d8b-47c8-b9d5-ce5485cfe3db", "indicator--1e5f1ee1-07ab-4cd6-9c85-e2601e50d895", "indicator--73ba12a6-2c50-49ec-bbad-82d0bd33430a", "indicator--ee6b7c1a-4160-4e8c-bd4d-8454834976f2", "indicator--77504325-c6b0-4ac1-845e-a907532e1d48", "indicator--b9a120ca-0253-4201-9ae2-a6d00be0ac23", "indicator--fe41dea5-f80d-4507-b5f6-bdba41a64e37", "indicator--1c074061-8d6e-4317-b44b-6c4add56a58f", "indicator--b055b2d5-24c8-4dbe-adf4-495aa33255ee", "indicator--8ed681c6-f25b-455c-8bf6-b223c46d527d", "indicator--bbc80846-eaba-4d87-8598-0828798e4d54", "indicator--4878d72b-16c5-41b6-8370-bf18ca093eee", "indicator--12e5c7ef-c909-44fe-b110-a3a28ccedd99", "indicator--9307d9f4-eed3-4860-b3e2-fc2230135f33", "indicator--75bcd732-3d58-4848-a2d8-d666968717ea", "indicator--ba459b3d-9501-4119-bbb7-2833ddce404b", "indicator--b37de932-38e9-42a3-b51c-150118c18e69", "indicator--6d87376c-608d-4aae-82d0-0be9808bf9db", "indicator--6441c559-79ad-4352-8410-834a4e1e4b14", "indicator--f6c752c3-96e4-4fda-8854-63fa680994f6", "indicator--638ea721-ef43-4cd8-9b81-71a820b1ba7d", "indicator--7e3c09ee-e289-4525-ad63-55ba1c6f97e7", "indicator--e2d2fb60-5a88-466f-9488-3819c27a23a0", "indicator--bae332e8-5563-4928-9e64-4675cff97c7f", "indicator--dc8f67cb-e5b8-46f5-b329-d80a55067f52", "indicator--40ec46ba-6658-4baf-a287-0bac3daaad8f", "indicator--cfbc1e13-7603-41f6-9111-39c30afbc1cc", "indicator--12560346-c4ff-472a-bca9-024d879d768b", "indicator--c1a2a219-f58e-43d0-a67b-d6bc757fbad6", "indicator--d885add7-bfd8-4c50-86f5-6580435503a1", "indicator--f4df18a2-3f4d-4920-98cf-296be1044c78", "indicator--77d3789e-0220-4fbe-918a-5e1341830777", "indicator--11e56e2d-7974-41a9-939b-42a86ae51462", "indicator--c49f96b5-531c-4902-8fc9-48bfbbdb3b13", "indicator--13766c2e-30d9-4fff-8bd4-9a79bb88da19", "indicator--310c2ce1-dc7c-4b53-9aa6-657122bd7faa", "indicator--6cae55f4-eeba-4175-91c1-dbb8ff4c0d66", "indicator--ecf17522-e950-43f5-97a6-398b32082f63", "indicator--7b9ad99f-b5e6-413a-b8d5-fad7e5a20f96", "indicator--6fba4926-fbce-451e-9366-f42aa6fbcff4", "indicator--d08f23cd-750d-429c-8a7f-1c78733a0ce9", "indicator--2ca33757-cbb3-49d0-992f-53cbedab4b6a", "indicator--ceaacd9e-f359-40db-b11e-5cbf20476668", "indicator--1000f488-8e79-48aa-997a-126fc3a28640", "indicator--e8506c49-6964-41b8-8efa-9b399de61242", "indicator--b9c4783d-6f4c-4514-91b0-ef3257ebea08", "indicator--528bdf5b-c3ad-45c1-8a3c-1216aa94b98f", "indicator--babfcce4-a37e-40c7-923c-c0e1d8f41b50", "indicator--d6cd8b1a-569c-4b7c-a14b-c134f4c24dba", "indicator--d759de9a-0e25-4449-aebf-89fc75c00e11", "indicator--d29d60bc-6a33-427d-a864-75e7cf57bed3", "indicator--1a4fd84b-ed48-4e4a-ab2e-778101522d1b", "indicator--eda5ec46-e6f6-45ba-940e-83d11342173b", "indicator--4f6d0bdc-1d28-4720-bfc0-0fc0c786cb24", "indicator--393cc871-9b23-4d26-baab-b906c3e6e334", "indicator--c3f3e9d2-f4d7-48df-bdaa-70459c8b0fce", "indicator--b4b85a38-ae9f-4ab1-b273-1e2d629709b7", "indicator--b7f7f1f0-e900-46c4-9a70-4823a08e8017", "indicator--365b9996-58c2-4d92-bdab-e6a5da8f9d48", "indicator--5e6123f0-908b-4512-ab57-a6245e4d9e06", "indicator--4e9dbc82-d303-4b2c-8619-051d42714166", "indicator--528da01e-16ad-460b-a652-033981c33fc5", "indicator--314b81cc-c9a5-490d-be34-06512a0077cf", "indicator--fa21569c-1238-41f0-af74-b4661db350bc", "indicator--f2cdbce9-00fa-46a2-98c7-f5d64d2a0af4", "indicator--b8e5b290-9024-4ede-b62c-04ded42de70c", "indicator--502e6d20-9668-45a8-a178-f03d00b17498", "indicator--d972f4d1-1387-4f82-8460-33dcac2312ee", "indicator--971e2d56-be8f-43bd-a37f-0a842211b7ec", "indicator--acbb10aa-4aa7-4173-b13b-1ef655ed4c67", "indicator--fa341dc9-348e-4a35-81c8-6edf235fd4fc", "indicator--7985bf99-4534-454d-820b-2ce14dbde064", "indicator--cb38ee7e-7821-4757-a5cc-d727c48d4296", "indicator--a2550b73-06d2-47e6-ba7f-a77f8fd60444", "indicator--70b9d8c1-a426-4e9c-bac9-3c133534a2fc", "indicator--e216bff5-be1b-4dcb-b734-09238839c0fe", "indicator--5ad1ecdd-1c5b-4717-9b01-b9e32ac1982d", "indicator--d14b73dc-aa4d-4fc5-a054-9a4494481082", "indicator--f27ef40d-f821-477e-be35-cc7b70882005", "indicator--f0cf699e-e0dd-4668-9cfc-a50988ddbce9", "indicator--44d6656d-4f7f-4ca7-bc5b-e793e7b47e07", "indicator--05fc7a3b-163b-4625-971e-cc4f29d5867b", "indicator--21c18383-c7a9-44c1-8edf-1e770d192e3e", "indicator--d07f4ab8-db3e-4e5a-a58d-61a78b0735d7", "indicator--28bb430f-d5bd-4103-add0-ce90b5ad7f55", "indicator--9bd7d66d-d951-49ea-9632-5ff52d4674d0", "indicator--0bd5ba31-3bb7-4aa4-90e4-c05d5f05e9f3", "indicator--3f677459-4957-4343-b461-319ecfd33676", "indicator--911a9033-09df-40b6-a5c1-586657600319", "indicator--33f06b21-b8b4-44d4-8a9f-bc18b7125adb", "indicator--832ddd60-2334-4697-af8d-bea3beae5243", "indicator--112701be-5b1d-45c0-bce1-c9b640f1df4a", "indicator--723d5ceb-dda8-4f68-82d6-0cd9a2eafe94", "indicator--7b771eb5-a89b-46f7-9534-dd58b97725b4", "indicator--c9900af4-7f96-4ee7-b87e-dfd3ea23f6e8", "indicator--fe1d3b91-99df-49c5-ab69-8d07489a111a", "indicator--a11c1ed0-c337-425f-aa78-6d7ca30c4af2", "indicator--f48be31c-25d0-4a2d-a31f-5ba1f1e7ee18", "indicator--20b96e19-f915-40d6-bf65-6253139542a2", "indicator--90c052b6-199e-4c2c-9893-71d59596fcf4", "indicator--f719e5d6-e336-411c-ac47-e9bc300e54aa", "indicator--b0eca258-c4ee-46c2-abc4-0ee0902f363e", "indicator--54cd787f-7b6c-42c0-8c01-35eb42ea6e10", "indicator--89df2e09-d43d-4078-bf75-28d0525a4b13", "indicator--0c9a2a64-d29b-4c3e-a2e1-22df06e2629c", "indicator--f29d4d7c-d311-49ee-a55b-30e3a426a641", "indicator--a7f43f3c-0c91-4ba4-94f1-4a034b918231", "indicator--b52273fc-cdaf-47dd-8b02-6a6fe9a5bf64", "indicator--1d8ce969-90ae-44e6-8608-04654f92eb45", "indicator--fe0bae7d-9796-4295-9217-e7efe6c07c87", "indicator--c528958a-2487-4af4-97da-65a4b8f7aaf1", "indicator--f8509264-5be5-491d-8a53-5125cfe8cbcb", "indicator--9baba5c3-422d-4a01-a48d-718727f9d61a", "indicator--dedd953b-7b63-4a31-9f3a-17ecfc261b71", "indicator--fd75eeee-9b87-4231-84c0-de7c0a578891", "indicator--4f3396bc-77ad-42d4-8780-2b2c3d534021", "indicator--455db7a8-e740-4dd4-baaa-845a7ec61b3d", "indicator--f01b8d82-897a-49f3-8679-8c9d83e92ea3", "indicator--23735906-db77-4054-9fd4-ea15adffa218", "indicator--0c58ee24-4019-4710-889b-efc729eb5733", "indicator--9fa11c71-add8-4c0d-9931-5b46db816ff7", "indicator--661cc194-49a1-4ec8-a586-26e3714081b4", "indicator--a7ed5011-a360-437d-a032-f1eff85f6e30", "indicator--42edc694-a609-4b02-a5db-d2092022b61b", "indicator--57b1cbac-8085-441f-a80d-9ad28b2a1d1b", "indicator--1539f9a5-ed96-4411-b529-845370eeaccd", "indicator--4f87a3dd-2404-4096-9dad-1a794c89a7dd", "indicator--d2f1d423-c44c-4d35-8ca1-be5991b6d631", "indicator--3e08648f-bcee-481d-b9fd-90520175545e", "indicator--67ee8ef2-73a2-41b6-854b-52a7ccf30357", "indicator--f64047db-9847-4d2b-8b39-17e5ead38c38", "indicator--dbb17212-aabf-4eb4-9b13-679cb5d239c7", "indicator--120ec3f0-b065-4a54-b43e-b14039ca0a7f", "indicator--ae4fdb9e-3d7c-4383-b138-a56661928a2c", "indicator--dc784fdf-029c-4057-a763-1ff39a2af4e3", "indicator--108c2272-45d5-4bc9-9ca1-371961c789f0", "indicator--88b19a25-fb71-4e9c-8596-c6dd82dd49f7", "indicator--0424d16e-b691-47fc-876e-345fc8b088e9", "indicator--28a02bc9-030c-4d1b-aed6-b2610866879d", "indicator--803b62c1-30cb-4602-b9b1-e5a73dd5564f", "indicator--bd7bfdb7-36fb-43bb-8a2a-f447c7e911db", "indicator--769a26fb-a043-418e-a5c7-2e3ec193166d", "indicator--30d3814b-d27a-44e6-9163-adda2e823cbc", "indicator--f49d9585-9014-404f-9cbe-4f1619fab0da", "indicator--8dd0f86f-1650-457b-8aac-a798e4c4b465", "indicator--e841e6b5-8e17-421b-a849-b3e54e780ebd", "indicator--7f22d91f-355c-45ec-a60c-dcd2d7e0a461", "indicator--0e821eb6-80cc-480b-8ed0-2d4ef0fe1692", "indicator--a992847f-cb37-4f99-823d-89e88a358675", "indicator--ca7523c9-eadb-45e5-b075-c30dc3b7e08f", "indicator--cbb72513-44f6-4af7-bba1-343a50741135", "indicator--a3e47867-c51b-4af4-80d5-25efc040b273", "indicator--813af638-3c97-4f32-8dd5-08437adfcf4d", "indicator--5e49c430-fe14-44a0-95f1-8c2aa0019ec4", "indicator--5032326e-bf81-42f3-817f-48eb5b60a772", "indicator--d312386a-5afa-45b5-91bc-d7b751df8360", "indicator--592b1cb5-f165-4898-93ce-9d9167c26cd9", "indicator--3b652d02-9cb6-454e-8144-87e5c096edca", "indicator--f028b334-984f-4354-8620-2e3fceede59a", "indicator--17c9d878-c33d-4792-a4b2-a2575c92784a", "indicator--830e970e-04f8-4c42-9ad1-b6143d280610", "indicator--8a97b06d-72bc-473f-80ba-3ea67f16bd4b", "indicator--84e2f535-3308-4a06-8a24-a0e1f07c461e", "indicator--e708be42-f5bd-493f-8127-3290d0c54a93", "indicator--54812680-2a34-4630-ad8e-aedb7cf7d8c3", "indicator--34653479-aa1c-4197-9d32-7e30b06d38fa", "indicator--45568f5e-061d-43d2-8ddf-e61236fe920c", "indicator--be8c8f07-a4b7-46d6-81df-86864a58a403", "indicator--23d05965-7217-483f-8697-a0142b39d241", "indicator--e50e6e16-9487-4fd5-8fb6-441aa115e409", "indicator--718e8ceb-b459-4110-9c2a-2a5acaac6df5", "indicator--97e29d94-e04a-4ba5-bbb0-25f69ff9339c", "indicator--e64e415a-4c9f-42b0-aead-105fba0dc3ae", "indicator--6e884a01-cc25-4e60-8aaa-db4ecf6ea8be", "indicator--7f17b25b-ee68-4680-90a7-d1d2786ecb13", "indicator--52830bcb-1213-47a2-b922-429e6f5292e4", "indicator--1172fa96-95a8-4aed-a0d2-c794d246a9ca", "indicator--e5f0c48d-26b8-485b-a163-016b94f94a57", "indicator--dce18864-326f-494e-b73b-d80c2e42620d", "indicator--0d480c17-7ea0-4490-a302-e7d6f4fa3b00", "indicator--de6942d6-04dc-4d47-bb0f-25c34cf225e4", "indicator--e36b71fd-80cb-4c1d-8a06-85b19e9bd3ce", "indicator--5692fd5c-49bf-445e-acd2-e5427506bcb2", "indicator--4b1ee2cb-d207-4e94-8e46-050b5158b69e", "indicator--53fe0eb3-d0e0-4169-9e5d-d65a77ef1e76", "indicator--eecb3950-9925-4fa7-bf64-481b4994f584", "indicator--d39caab0-495e-4d1f-b69c-80d96c9b60e1", "indicator--6a8b0584-aac7-42f0-81e1-0781652348c5", "indicator--53706b53-970d-4a3f-8762-d83894c91c0c", "indicator--874107dd-e4b9-4b09-9649-147e9f81f0e7", "indicator--7a2f22c5-75c9-427d-b67b-fb38684ed1a3", "indicator--3b64684f-7317-4379-8e4e-991aed0c1491", "indicator--76a082f2-fc16-4b90-8a31-b00f1a5c8602", "indicator--68ff0fae-80bf-452e-8ab5-3ba120bc5cc5", "indicator--b6354b2f-37a4-4ec7-94d6-d55fe117aa21", "indicator--7462e24f-4216-441f-ae05-f4181f097e1f", "indicator--8e4c1e90-b3a9-4ed6-b482-2886509eb1e6", "indicator--6694527e-dd22-4815-bfa7-a30c28b355da", "indicator--c6b4a85d-583c-4aa9-84fc-71abc1317450", "indicator--1fcccba3-2058-4db0-b828-64738b1a297b", "indicator--511c66b1-c1a2-4f59-90f8-620db240fe70", "indicator--272e3eed-5cc4-4402-9f57-736628fd6710", "indicator--5d911ddd-668f-4d11-871d-a8e49844e653", "indicator--7788f156-edde-4f65-89c3-2e3e525a3e66", "indicator--012c4376-2a4d-427e-a905-e1e913af4b2f", "indicator--2e2fe9e5-52d3-4803-b731-000a2c5d391e", "indicator--3bd98d0a-d7cb-4ee1-8a37-211a8690dbf5", "indicator--40e2f950-1243-4847-bbb6-6bfe277e5350", "indicator--b2980892-3228-4b01-a2f6-960088a59f58", "indicator--01053845-6ffd-4420-b90d-4425bf988df5", "indicator--18836d87-4c42-45aa-a248-ff2286014c51", "indicator--f7bb56c6-79f9-43c7-85ae-337e603c4d41", "indicator--a07ac76f-3ef9-43a9-aab4-bc9305fb3d51", "indicator--698927c6-71ae-4f9a-92bd-d1e8241160f4", "indicator--1e3f6c91-a21c-4104-a40c-d7da9c0076db", "indicator--7470b777-3a63-49b5-8599-aa4c1fe23ea9", "indicator--aaa73f07-832b-4c66-a809-642c815a7bb4", "indicator--7259f608-ec14-4e80-b5dc-30468d4aa54b", "indicator--3afe6a46-b163-4175-adfd-b28fcc7a92ed", "indicator--68991caf-617b-4cb6-9781-75a0317ee032", "indicator--01ccb9cc-2540-4ca7-889e-7d19e2713cfc", "indicator--75bfa1e9-955d-468f-8f2c-927460514b31", "indicator--bf13505b-1f01-431f-b7a8-c806ea3f462b", "indicator--fa8809fb-47da-440e-91dc-f13d46d381df", "indicator--99062025-9fd0-4d3a-bb58-6c1bf9224272", "indicator--5331b9b7-9e87-4cfe-ad22-c30a1123a69a", "indicator--80214fa4-50e3-457e-8495-f81188f4b04f", "indicator--2d23a863-f1f2-4a15-9a4c-faf9ab508a2a", "indicator--1f63ed8a-4891-435f-977c-a172042fb9a2", "indicator--ece0d464-4e95-41dc-910b-ded149d4fad2", "indicator--a18f4e7d-79a4-46a9-9cc9-27720b577fd8", "indicator--d9f82ba9-2a2c-4901-a1e0-a4b5ca2e90bf", "indicator--6aab3a1d-2366-4ece-96dc-b343cac0e4e8", "indicator--a74af707-a823-411f-88f5-90923dcdd631", "indicator--a64c3fc4-486d-49a5-af5b-afd5c7cb0421", "indicator--641d3d52-b2ff-4b87-bde0-244383a5cc94", "indicator--fc08b647-4a79-4fb2-a036-d059e0dafdcb", "indicator--bbb9f259-58a6-422e-ac5d-03fbff1e7435", "indicator--b66de1b3-ef01-4a97-8648-3112e95a825e", "indicator--92b07e0f-cb76-479a-b7e2-f1a20a8f9e11", "indicator--8cb67165-72c8-452b-a0b4-765d7065196c", "indicator--8ff19dd0-6915-419a-be23-421cd309aa82", "indicator--f2101293-f991-465e-a91f-9ffeea0b473b", "indicator--2d2dd76b-9f57-4347-a5fa-26d32dd7fe5e", "indicator--f2b06c01-18f2-4592-a063-2ba223b443e5", "indicator--05235a1d-31d3-4c40-9b06-6f15aa3bf0ee", "indicator--d5f18b56-bcb7-4d3b-ab02-3feb73d12a9e", "indicator--4d15406f-264f-4c7d-aaad-ef14eb6fb147", "indicator--2ee1fb41-3d67-42b8-8a01-7450054fb82b", "indicator--275b18ee-2404-4e96-9513-ae13c11478e6", "indicator--e9fdcc1f-ecf6-4a1b-90f3-9f42017c1c20", "indicator--529a3e6c-00ac-4695-a79f-d09d7ba2eb0c", "indicator--5ae75e25-c3b4-4ec7-bff4-4307fc095b7a", "indicator--36c6d9b3-5129-4872-8b3e-f485a4a90944", "indicator--838277b7-6a49-4854-839e-2663f48443c0", "indicator--71fe4c7f-b4b2-49ec-894e-b5ca4b512347", "indicator--567d0795-8b79-48da-8fc0-15ba98e93630", "indicator--53d6d692-e98c-44a3-8883-774e7a7cf2f7", "indicator--518c4aa7-e0d3-416b-9637-12612299f160", "indicator--3d38e680-10d1-4396-8017-38a76044457e", "indicator--616c1bee-088d-47eb-bdc6-006db1006799", "indicator--e5ceae75-5033-48e5-b580-58cc33716a6e", "indicator--40b6d679-7c56-40b9-b585-44dde7ec3d94", "indicator--d5781b94-b6b7-4bde-9dc9-c518fbf93851", "indicator--0c30c211-4eef-4a6b-853c-8837d02002ef", "indicator--1fdba83a-c860-4ad7-8d55-496e81fd98b9", "indicator--fbe555c8-841a-43ff-9679-6288acc21e4b", "indicator--ba7697e5-b30c-464a-a702-50a4bfc1fdb3", "indicator--21b67625-3a31-45ec-83f9-2a2c891f2664", "indicator--03b44ca0-745a-4c39-821b-f52d816e65b4", "indicator--0f6a0311-2ece-4da3-99ea-5563accabf98", "indicator--7e04b8e4-f242-44c6-987d-fa02b79ec749", "indicator--6eea0c6c-8bc0-4727-86cf-fc6a6d086d3b", "indicator--59f6445b-3597-4968-8289-f47d16085ed9", "indicator--d02575b2-be27-4092-90e2-172724d0b4f3", "indicator--124fe4ee-2de1-4d3b-a11a-d4e3ba3e6a79", "indicator--a2bee164-9239-42b5-92ca-b89f2fffde07", "indicator--c37da4ee-242d-4bf6-b42a-ed762f871a0a", "indicator--ce4eaacf-29d8-4237-85e9-142cd778a4eb", "indicator--5c49b94a-b6f2-4df1-9b14-54ff0b3e4956", "indicator--3b560448-253c-4668-a971-20b9c5bc368a", "indicator--c51e7334-695d-4460-8e44-5bcd253bad21", "indicator--8893a8d9-0000-4300-960c-35a71df1fdd7", "indicator--20897e30-cfe1-498a-83ec-0393bb20c55a", "indicator--38f20db3-f368-43c6-b335-fc9c61b74dcd", "indicator--61f924b6-e7f6-4cb8-b80a-467b0f00a960", "indicator--fd133fcc-d577-4d2b-a4a5-b2cba6e18e1c", "indicator--a7e67842-8134-4400-83ab-2f14f4bfd364", "indicator--5974c8a5-5762-41c0-b294-2cbec157bf94", "indicator--3c2e6b50-9d49-43c0-8484-0ab396d98bdf", "indicator--e97fb2a8-9534-434b-a331-0b78df470f50", "indicator--056fb2b8-ad65-4212-a089-378ad3472f10", "indicator--7814a03f-3e4e-4f27-8938-06bef554928d", "indicator--2e012ffe-6122-4ccf-be4f-c99b91178a3e", "indicator--fce16691-041d-4419-b920-0082b55ed97f", "indicator--3734c2c7-b9ae-4558-96cb-3a42c26089f8", "indicator--3f449e08-417d-4063-946d-863eadb4ae7a", "indicator--2db55f26-b635-4398-8327-c9e0d94acd59", "indicator--5f2cbd02-a47d-491d-bbf0-39ba170896c7", "indicator--e379147d-bae9-407a-9d98-424c887d84d0", "indicator--a95bd803-a69e-456d-b70b-c8299ced148a", "indicator--67449644-8946-49a4-9a74-ade87e29eeca", "indicator--629af1d2-19d0-4f6e-b326-a8d548a78045", "indicator--aace36b3-5d89-4b78-86f5-212bfac0e7ed", "indicator--216d3f93-49c7-49ef-a7f5-5f5f8bde83c9", "indicator--409dcd04-1598-42ee-8549-56566c6b462c", "indicator--7a01832c-0bbc-4247-b74e-9bb4cc40e815", "indicator--6b6ce096-8333-4faf-bc2c-de430cc366e0", "indicator--32a6fc2d-67f4-4b8b-8b7b-3c95bbca1f9d", "indicator--92f56725-f91c-4d8b-8f26-fa153982eb6e", "indicator--4851199c-85a8-468b-95c0-1c311fa0c8c5", "indicator--037abe04-d3d0-4ee1-89f1-a29856c127d5", "indicator--f8bc633f-dc03-4c35-a5da-2010518d304a", "indicator--8bc4d4a6-29ef-4d9f-b1cc-6f15d5581500", "relationship--a489deb8-edad-4efa-b48a-569b98ff76e7", "indicator--ae4e6ac5-f44a-4f0e-bac5-772f8c1c9c90", "indicator--5d0af5d5-a256-48e7-9a5d-f14786afcd10", "indicator--f71bebdf-2092-4b25-964f-6d3c2d94a878", "indicator--817398ee-8eb2-47dc-94bc-2a7e97b908b6", "indicator--94f6045b-eae0-41c0-b9dc-a17f5cc58161", "indicator--1576a5c0-5b7b-4a6f-ad06-c45be6123659", "indicator--b6af88a1-b188-45a2-a343-524daeeed4fc", "indicator--1351a01a-b176-48d5-9789-6249df4f0c05", "indicator--dfa03b09-f280-4d7b-87b7-028a9a1c4287", "indicator--1d9cffb5-0ba2-4c18-a86d-2d0d21502014", "indicator--2e95d151-583b-4a8d-aec0-5e51919db572", "indicator--fb7d540c-9412-45cf-ab16-7d5339df3cba", "indicator--b39f3842-a3c5-442d-9179-ee52ee2cab67", "indicator--740dc0a9-a54f-442c-b431-78a89df13a8d", "indicator--f5ca5713-b7b0-4858-915f-f9c782ec805a", "indicator--b0e3732b-a8b8-45b9-9eaa-2b9e8dc06e89", "indicator--7f63467a-fc5c-46b4-9195-fb3861b08747", "indicator--ba14fafc-8304-49e3-b1f8-cfcab5c5c6f6", "indicator--424163d4-9231-4376-97c3-c10e820849f5", "indicator--a212c294-7e8c-49d1-a004-f3d2e0bf8710", "indicator--8adf7c3e-b93d-4110-8b10-9b19ce80763f", "indicator--5693e939-88e5-43e8-bd6b-4dd8db1f0c78", "indicator--1399509e-2afa-4dc4-877d-488e80b7dbf2", "indicator--a12dc20f-c135-43ca-98c5-d04dffb05e8a", "indicator--18a8c46d-e930-4b33-934c-c56b121e1d28", "indicator--1f023b68-2616-4c5e-bdad-c17328c82b3e", "indicator--94b95301-48fd-49a7-b5b9-128472bc9763", "indicator--99e91b79-0783-4594-afed-16c57cb0c3c6", "indicator--4df6b354-c051-44dd-80e5-56c44f078f3b", "indicator--e0b2a6c7-1619-4722-95d2-e72971443820", "indicator--8e932782-748e-48c4-8884-95e16b5fd66d", "indicator--0ed86070-bbf9-41de-bc45-7978ff15c258", "indicator--7c920c3b-ec5b-421f-82e2-07f610971e84", "indicator--a6abbc48-33f1-4bef-8046-f334e9222837", "indicator--cb7246d9-7b86-4107-b8c7-e0be9534782e", "indicator--43dfc341-c575-4060-b7ec-519f60423d17", "indicator--238b3daf-04a8-46ea-9acf-2c1bb6710212", "indicator--5f801883-c7de-42ea-9187-682114244556", "indicator--362e3c0a-0587-4a7a-ab53-c119e29f563d", "indicator--3f68d266-30cf-4e63-ab76-728c524a72fa", "indicator--c2da0e03-dedd-424c-b719-f568648e5b9e", "indicator--954640a3-7775-41df-acc9-98c4da74dde9", "indicator--bc37e5bb-460e-45cb-ad4a-0248de961e52", "indicator--e17b80dc-69c9-4766-aa8a-6daf8a717ac6", "indicator--9b555038-4fda-473b-aa60-5af45b62b718", "indicator--fdcaeccc-321a-44d3-80ab-aeadf262895b", "indicator--ca7f8928-f322-457a-b46d-f4e4b146eeb9", "indicator--6abc1dec-8ae1-44aa-b398-a34632165574", "indicator--377e3983-ba41-4f83-ba6c-0aadf436264b", "indicator--04bc50f6-a4d5-420a-b601-7a3a954e4ec3", "indicator--047abd41-7d87-4614-bafa-15a8a9971cae", "indicator--b709158c-62f1-415b-9be6-c6e65faa1176", "indicator--76259076-df66-4f90-bb6e-f9c3344427d1", "indicator--e6bbac84-d359-41ff-a367-aaa379b09cd6", "indicator--df0f4c60-af26-4cc9-863d-ac4618a52265", "indicator--9ecb531b-62b5-45e6-b54d-4b20717a6ccd", "indicator--35e53e6d-5a9a-4074-95e3-296307c4da68", "indicator--23f725f5-5ad7-459c-836e-effe61aebd95", "indicator--0e3f655f-7753-4315-8c24-829188715cd9", "indicator--fba42301-2003-44fe-bfd3-8d290ec48afd", "indicator--5c680b92-6229-4f2e-a75a-491217062d12", "indicator--775bc3cf-9bf1-4f7f-bd65-bc254b105e55", "indicator--7bb6fcec-ccd9-47d2-9dd9-48e06ec78d54", "indicator--68bd091e-1e14-4c33-baeb-24939d4f67c8", "indicator--c2eb167d-fc01-4b27-b28d-e933bfefbc74", "indicator--56b5632d-9082-48f8-9f36-c159124d81cd", "indicator--b779a473-f908-4006-8ddb-a05c689cf4b2", "indicator--873f2e6b-c29c-4f49-9ec3-6dd428829c9e", "indicator--71c5da7f-78e0-4c97-8cac-90cc3082c1d3", "indicator--6d308dbb-e255-485d-bcd8-de1a3db21785", "indicator--291f1e30-bb96-4391-9559-07385d2abfbe", "indicator--71f42f93-6c48-4d2b-b97d-67c99f695bad", "indicator--3ee48e8d-a786-4ce7-b54d-a5ab1104547b", "indicator--4b583bef-c9a2-439a-9962-6acbb51bb0d4", "indicator--34feb955-65e8-41fc-8a78-a8005df087e9", "indicator--3da41ac8-4aae-4c9f-8364-ee2882b22819", "indicator--7f25d2b3-3db6-4a77-9e3a-15c45eb20aa5", "indicator--d13d4efe-d363-48ee-a80d-1109f8341108", "indicator--b5e90e37-31f3-4874-80e8-a44d32dbd1c1", "indicator--6f171e2e-66c5-4f5f-b739-74e58f8c490f", "indicator--53ac3179-2fdc-489e-b0b1-1d00750e2163", "indicator--6c3bba6d-af4b-4ad8-9da7-ccb015ea113f", "indicator--c1d84880-d61d-4801-8f24-1d73034de492", "indicator--e73d887a-7c40-4a74-8f02-2d7858ff0be2", "indicator--fa7b6a6f-7da4-4417-9fb3-63ba09f43c0b", "indicator--f91035a6-c5ea-4cec-83e7-90682881cce6", "indicator--420b6975-fbae-4b92-9566-a304c4c53f04", "indicator--2f9796b2-d5c1-4a53-9451-68a730bf094f", "indicator--68bd716a-17fe-49ba-b90a-874e9f1bef2a", "indicator--51aab9a7-494e-4e3b-b41b-0078498575b4", "indicator--2611be58-7635-45bb-9760-120042611b60", "indicator--c1894710-de3c-42fc-b526-6556af5c93eb", "indicator--cbc8fd1b-3436-47a1-9577-703e4590fe8b", "indicator--cffb3c5e-ff54-4cc6-8561-0966a642b6aa", "indicator--518bc588-7ede-4334-8fcc-aa538c679f8c", "indicator--8f515d20-4e85-48c9-a724-b6eb57d477cc", "indicator--f02d7f53-bb5e-4990-af80-bc87bf374110", "indicator--a17f4a64-1fc6-421f-8ddb-a41a140bb799", "indicator--995e095c-f32d-4fc1-986c-721905a0c2ad", "indicator--3242f072-0e09-4b8a-ba8e-b45d0063b633", "indicator--8e482c97-9853-4a9f-b1e7-66b1c10b6796", "indicator--03dc654d-c9c4-45f4-ac1a-6ddce8ee816b", "indicator--7d889144-7688-4dad-a27f-d477f64d6988", "indicator--f433d181-1760-4276-8986-bdb8327cd285", "indicator--05627449-6a19-427f-84f8-d9a4a3e753ba", "indicator--131fc844-472a-42d2-8649-161de7200ce9", "indicator--011c5b96-f4b9-4f9f-a293-faf74c2eb24b", "indicator--a839ce4d-9ace-47ec-8574-5e661075eba0", "indicator--c97bfbc4-8b24-4723-b12f-70d00ee07bb0", "indicator--00457107-5c88-4dc6-86f0-cf35425f7c47", "indicator--fcebe8f2-8b00-47ba-9000-0c8e77592e82", "indicator--53e1cff6-88f1-48ed-beca-71a64484806a", "indicator--aaf199ab-41c7-4e15-a017-3860830c5a1a", "indicator--048d08db-8ecf-4f2e-be1f-d64963c07fec", "indicator--f7357b6a-8d7e-4377-9019-5283e2b2ec6a", "indicator--4201c441-8f18-40d7-93d0-88e6dabfb76d", "indicator--4792ab96-e1dc-4f4c-b377-04788c92d53b", "indicator--cbee35e6-4611-454c-806a-c1547ed38ea0", "indicator--2d65ddd0-cb28-402c-9d45-de0ea9257715", "indicator--86dfdda3-dce8-44c5-854f-ac38b8db315f", "indicator--d5b7551c-62f7-45fa-b302-e745eefde268", "indicator--3e93da8c-e0aa-4a9d-94c3-8674e170f0f8", "indicator--5b93d460-2409-4651-aecb-ba8bf7761aaf", "indicator--80c826a1-72cb-40b1-927a-71f2172a4e52", "indicator--d9256162-e132-4e9c-a820-e977c032930e", "indicator--de387b1d-ab81-4414-920c-c4c254218ac4", "indicator--f1df2999-f287-464d-9ed9-9cca56c8664a", "indicator--b16ba70f-b4c1-4545-b253-4b61baf8a301", "indicator--42d94d7e-1828-464c-9119-700fa0fe6255", "indicator--0b8ad4ef-9f0b-43ad-a8d6-be5ba87f8c5c", "indicator--e2ffb6c5-0b46-4a80-9e42-da635b6f7419", "indicator--8d3820bb-f4e6-4835-87ba-a5bc48a1e99b", "indicator--0e497f96-f94b-4a4a-862d-18464563685c", "indicator--70657191-7cdd-4a26-843f-f7134f7371d0", "indicator--9f0ed880-3b55-44e9-acae-b8fae4af423e", "indicator--9e2d5682-ff78-4551-b943-98ecb1d274db", "indicator--4a313c78-1ecf-463f-ad31-be9ead79bf16", "indicator--13749521-1e1e-4c89-add3-186f7dd22253", "indicator--ad958c34-8ff9-4cf4-802f-cd9fc8762b56", "indicator--494c3649-b2d4-4ec0-8a69-c075f4ae6f84", "indicator--104ab9db-6e6c-46db-a029-6a2c7a2b0e6f", "indicator--e2c0a635-6ba7-4b9f-b0c0-66fe89fb5760", "indicator--5eb0adba-143c-4644-84a0-e92f60705584", "indicator--f12e1d0c-a806-4d04-bd57-132c35cbc9c9", "indicator--6eb4378f-92dd-47b3-905b-4c2e0df8cc9e", "indicator--5a087729-f116-4611-99c1-f02d56a5ab9d", "indicator--9a578369-6069-4f52-8be2-09dfb62c4e1b", "indicator--cded2691-d4ff-4ba7-b5d5-299c5e887660", "indicator--2bc0c1ba-a478-43fb-bac6-494c6ff8b910", "indicator--42951e15-a7c4-4e9b-b285-d173046eb5a5", "indicator--b0b4fde8-0bb9-40eb-bb01-63292b6b34a2", "indicator--0b773506-6472-42ad-8874-fb0ea1dee530", "indicator--24b5a12c-638e-4c4c-8236-4aae9a8ac833", "indicator--6429f2f3-96b5-4fe1-9469-705d450f35d6", "indicator--ccd6b9db-7b4e-474d-9d62-38d3d4aa4e6e", "indicator--ea471d09-04e2-4603-9c74-cac2ce2987a2", "indicator--dad471e5-0731-4b19-bb69-82d389c9fdd9", "indicator--5608a1ef-f470-4507-aca1-ac524ddeddcf", "indicator--0f6a390f-0dd7-46da-9ace-3acd0d8a8149", "indicator--b0e97509-51e1-407f-805b-9e64a7aa5fe5", "indicator--68f280fb-f511-4c0c-b167-5bf61b16d67d", "indicator--8065af6c-1c71-40c5-92ee-19b9876a8034", "indicator--b0a57877-8851-443b-b57c-4477f18ea347", "indicator--8fa4ca6b-a93b-47a7-8304-adaf28506d79", "indicator--9b7b9ed8-b562-423c-a8e3-8a96221f08f9", "indicator--5d325e1b-e756-46a0-b333-951dae8bc303", "indicator--78ca1e9a-d9e5-4b57-9001-4f1261bc227a", "indicator--0bcac9f3-a1e2-4f57-a58a-52757d184024", "indicator--9e671ff3-572d-4dfc-9193-5bad02fb8edd", "indicator--51e69eb7-c8d0-4603-917f-da1e3d343342", "indicator--161ecd48-e5ad-4f52-92e7-56f57c359ae1", "indicator--669d0d3d-1c7b-4ea5-a3f2-506d42a696f8", "indicator--33f2e689-3e9a-4a5d-ae05-83e5b394f2c4", "indicator--69f175b7-0768-4738-b817-37d75311ff65", "indicator--643b9344-1dd1-4cac-a64c-0d3faa515db6", "indicator--3f19c3d4-f464-4e08-a92c-4b53d14e8116", "indicator--2b9c90fb-86b4-4412-9296-0d463ec3b053", "indicator--99b923d4-9444-46b7-9e34-ad9f6f15f935", "indicator--7e472191-e2ba-4b71-9fd8-23174ffc2436", "indicator--19072a09-ece8-47a4-8f3a-0067e38035ca", "indicator--0e57ebad-64a4-4550-ab28-bfdf348de139", "indicator--a341d770-3b0a-43b3-b086-ff936189f8ab", "indicator--63cdcc44-6eae-4cde-90fe-029248a597aa", "indicator--f93618af-20bf-4b39-9ab6-4479454f1dc8", "indicator--e25ac42a-a651-4bd6-bb30-d8d488cd086f", "indicator--91a29482-f183-424f-91d1-826480a0bd10", "indicator--469bce43-306c-4cab-8232-822d6ca14cd2", "indicator--4357166a-fed2-4a42-8735-2de1a931eef6", "indicator--298b10cd-61f4-41ca-9047-c5fda302adb5", "indicator--d8f0e180-1726-4272-a966-bca8aebef694", "indicator--809a8b13-21d0-4318-81bc-892f096c2bb5", "indicator--0ab8046d-a7b0-415c-bd39-29035736c70b", "indicator--98914aa0-4e44-468c-bac3-bbec131bdf57", "indicator--bb0ec427-0311-469a-836f-b61cdcc38cae", "indicator--3f9b88bc-120e-4722-a358-f69031e9de4b", "indicator--f1e1cb98-7594-403c-9efa-b938834c4ba4", "indicator--51f43b59-9c1d-43f7-b8d0-27a355a2383e", "indicator--6ec3037b-5143-4200-a199-c9cf4e7c79d3", "indicator--1e731469-33c2-4c5d-a633-1424363f2a46", "indicator--3fd1e136-ceba-498f-82aa-8d3cfbdc48fe", "indicator--8abde826-d628-4dda-b1e0-f06a86e92954", "indicator--17577c63-56b4-442d-b8f6-39133b586212", "indicator--fec0561c-ec77-40fe-99e2-7d307de00fc4", "indicator--57c4a487-9db4-4e15-ac77-7150f6cb49f6", "indicator--37172f04-62f4-480d-94f5-4574f35135e2", "indicator--373f35f6-4e02-4720-93d6-730bbf6b4ca0", "indicator--7399e001-692a-4f72-9d2e-2c41dcb0de2c", "indicator--0bd2642b-2ed2-4ae4-a481-a539bc2811e6", "indicator--63764917-60ac-4075-b2cb-705c57422940", "indicator--963cf956-8f7f-40a3-8820-dbeae87f86ec", "indicator--fa6d07b2-94a2-4657-91bc-da22f9d19bc7", "indicator--63e78e78-d131-4efe-97f9-9ffdad4373be", "indicator--34d1c56c-0e10-4d8e-8489-14c29e468276", "indicator--2cd5d11e-5b65-4910-b54b-ec2990f3290c", "indicator--e4bdb660-636c-48d5-ad45-81416a89fb52", "indicator--b022d7d7-f842-4ab7-b771-0ec9844aefb4", "indicator--9a9e24b9-7bfe-4565-bef9-b7fd57aa2097", "indicator--6f91f592-5b16-4b16-929b-be4aaeaec464", "indicator--dee9d6ba-8211-405a-b4cc-4d0ad211847b", "indicator--c6aafe75-a0c2-436e-8837-146d3c89c48d", "indicator--a7e21e5e-5648-4c2d-ba80-fc59ee0feb4e", "indicator--c8bf49c5-ad6a-4812-82ed-1f506c4bf806", "indicator--9e3ac248-c05b-466e-8150-397fb394201b", "indicator--5c126abf-3e20-48fd-a89d-504c0b368791", "indicator--415f2008-751f-42d0-9715-3995e4db8307", "indicator--bf7585c7-1c7b-4f81-93b9-e990df01b428", "indicator--b2495b5f-0965-4da2-bd30-792ee93aada1", "indicator--898e19f6-99b1-456b-b916-3f514079f0c7", "indicator--e2974e08-23d5-4990-a937-52154138ed44", "indicator--8c3c20e2-d693-4223-a7bb-35d18007ea22", "indicator--de5b8e0c-1fcf-4627-908d-f7f643181889", "indicator--d3572e76-050a-491e-94d8-14c920170a17", "indicator--f58b4024-49b9-4422-a8dc-8548426f1c18", "indicator--43130913-36e2-4c2e-ab7e-e08718d1b529", "indicator--40f74eb8-b5fd-4cab-8eb8-466e2720bc46", "indicator--d6916c5c-3b08-4db2-b916-7da24fbeafe3", "indicator--2f157428-8edd-4dec-bd43-67c6b324fc6e", "indicator--7a6e48cf-4548-41c7-b77d-da7fa2ce4365", "indicator--6a66496a-e331-4515-bd00-3f433b08d3c7", "indicator--2ca976a7-8a4e-4e87-b577-f92bc30d3dfd", "indicator--0d1e1f09-2522-4dd9-b0d7-523fd30221a6", "indicator--325df5dc-3666-4b5c-9fc7-4e89b22a54d2", "indicator--e8d7f2cd-1314-479d-8575-cf61eecef06e", "indicator--7c785901-119b-4186-9add-239de4feb021", "indicator--dac3332f-f0a2-40f3-a703-b70428ab9ece", "indicator--af3cdef3-5b52-4999-b98c-9c335280f114", "indicator--251fa5d2-0f6d-485f-8ca6-a399432c0366", "indicator--c2ab68cb-ab3f-4419-bb14-eb9fa829f947", "indicator--9e834151-08f2-40a8-a88b-552e4b27557b", "indicator--eaf67e66-420c-48a5-97d2-dab1bece2b1f", "indicator--a71625f1-d745-423d-bc74-f1fe2893ef9c", "indicator--39b55695-2197-478d-b46c-ebc3a09eabff", "indicator--71724db9-69ff-4c48-b35d-e8ea6f5e17c3", "indicator--2a24ce43-bbf9-4f8b-acb9-cf9a11dab63a", "indicator--76cfc910-0210-475f-9cdd-a20ed858596e", "indicator--2eb8ceb6-9566-4ea5-99b0-ec8df124df5b", "indicator--eed59830-5ff9-4c1f-b66a-83388e1937ff", "indicator--372915d1-b9ea-4a92-b6d7-cd85b2e79cb0", "indicator--be7f329d-994e-428f-bd03-484f2bbe0cfc", "indicator--6a8243b4-b235-4a5e-a0a2-a0d71b8a6c85", "indicator--a37ad82b-29cc-44b9-8dd4-a49e9a396d99", "indicator--515f7661-4ec7-44c8-92db-5816e2b27924", "indicator--8b7da4ba-07a6-4780-9aee-b937d5623308", "indicator--ae9f27fa-2e2e-4c5b-988c-80801fb9007d", "indicator--c382f92e-34e1-4f26-b411-6e0ceec5aa3a", "indicator--b2bef0e4-52a0-4dbb-a8f7-36eafa0ed537", "indicator--ea880680-7b77-4960-836c-0db33c2595e5", "indicator--833a8756-6152-4037-9f17-723ce4e5cd54", "indicator--623b2a8f-e89b-42ac-93d7-c84aac613c5a", "indicator--3af300d2-0526-4d89-9f6c-2e14ffb72890", "indicator--bc65d902-5c55-428b-9501-78ee0495d5fe", "indicator--7d2a02b5-360c-43c4-be22-12873745b78c", "indicator--b14a8d4b-4cd0-44e1-86de-db1bbfa817ff", "indicator--5151354b-d56c-4535-a590-978f6257b26d", "indicator--7012fe10-374f-4ca4-991e-a8f74d2cb00c", "indicator--9e80b3cd-1d8d-47f4-a00f-d422b5d375e2", "indicator--aa2a480c-8abc-4cfb-84e4-211220129dbd", "indicator--df535b35-cd8c-48e7-9563-7dfb2d9cdee7", "indicator--509b23e1-fa6e-4869-8090-455f2014f848", "indicator--1d8015bd-edfe-4684-bf22-79d8c3370148", "indicator--e9051e7e-bfec-47e6-9b83-4fd8b4d6b61c", "indicator--7112410c-7f5f-4d6d-9a93-2a90a943e1c8", "indicator--706de1f1-02a8-4d47-9cad-f5990f416b1c", "indicator--f88e70d3-e7fa-4d6f-908f-0f7242892329", "indicator--6f395587-3649-470f-9afa-94d150fe9c5f", "indicator--222df7f0-000c-4709-bbd2-8dcc02efee51", "indicator--bd2d1259-f4f5-40f3-aaf1-7ac3781d141a", "indicator--f13d7bee-e79a-4103-b0b0-28e9dd876e0d", "indicator--02d9bb14-4ac4-4dcd-bcf6-7e751a78047b", "indicator--fc8dadb6-25ff-4726-9112-3a44ce20fe1d", "indicator--db346c90-1d4b-45a7-8f08-0b3f88bca13a", "indicator--66fa010d-3653-4f61-865e-222860bb69b8", "indicator--e4fa4e9f-878a-4097-b428-dafe7229759f", "indicator--9cba05d6-861f-444f-bc96-6165bca7b5b4", "indicator--5b11e8f6-f007-437e-b340-44d951b59faa", "indicator--60d5de46-0edc-4059-ab6c-03e470971f0d", "indicator--a7e127c8-0d73-402c-a12d-b43d3fa6b460", "indicator--e1a3030d-ea37-46be-b02a-1035d91557b0", "indicator--5995f4f7-9da8-4f4d-a31f-386b2871ee74", "indicator--11a0cb8e-a95e-41c7-84c7-b25775a69c45", "indicator--10a024b7-14bc-4b7c-b2d3-2c440d88bed6", "indicator--626592fb-d718-430a-b13f-478e15ba8f0f", "indicator--7569d898-39af-4d6f-bc70-c1dbf3e6b184", "indicator--a7f819a7-8fad-4361-912d-624f8d66f464", "indicator--daa84efd-7f27-4e68-863f-d58872e930d1", "indicator--ac57d3d4-b792-4623-8af0-0670229bf936", "indicator--213ef3f2-655e-4247-9886-0657aec955ea", "indicator--a9625244-bb2c-4a40-beba-fbf8d03e8ce7", "indicator--a29328da-73dd-4832-b390-351f1facda88", "indicator--60ae118b-eec2-42f0-92b7-291837d9e590", "indicator--beaba7cb-d129-4bcd-8849-94f04bd853b0", "indicator--3653c771-1da0-4d31-9fc3-f5e7a3254171", "indicator--b03b59c0-35f3-411f-8d46-68e57fb52a55", "indicator--cfa8cbc1-1a7c-4b10-a8fe-91ab6e7b1942", "indicator--4735c94a-6428-4f7e-8a55-43c8d5507047", "indicator--538ab1aa-255c-4334-b294-6179e9848f87", "indicator--06dfc4c1-e929-4b79-88fa-e8c6c84b8865", "indicator--1b6c18df-a19d-4b3b-b5f2-620067224490", "indicator--489b9180-b13f-4420-838e-5abacf0ebfa5", "indicator--f53bb6f3-c886-416b-af37-41de66903587", "indicator--e54876e4-40b5-4ead-8f5a-2262969525c9", "indicator--a6841f4a-9b6e-4e12-a4ee-82d3c95037d8", "indicator--ae4dd2fe-756c-40a4-a489-15fb958f306b", "indicator--654625ef-644a-427e-8cc5-a50c43aaae7a", "indicator--a6cf163e-6310-4c4a-9b45-6d04ac7cf083", "indicator--a6ca8aa6-dcc4-450a-9ec9-7c70453d13b7", "indicator--ff43a927-dde9-4bf0-a642-809a1b8437b4", "indicator--f8468041-cd35-407d-ba10-00e86da9ca3b", "indicator--550d9d1b-318c-4e6c-a550-96f79f6f2511", "indicator--9cf4c9de-9b93-4144-87f7-1ac04f70ff9e", "indicator--b2bc3256-b90c-49d3-8e62-62fc2eba0b0d", "indicator--16111b53-8474-4244-abd1-cb7b202eb683", "indicator--11ee0614-048c-4dab-bfa0-a476263a662e", "indicator--4d803fe0-21f1-4b9b-a5c8-a9ced0337908", "indicator--c9ba219a-7d3f-495c-bc3a-d5cbc5aa3dbb", "indicator--499190f6-ef16-4e6c-a732-f31ad8d168ac", "indicator--e9063252-ea3c-4850-ac4c-b6ff5b7da60f", "indicator--42a07f4e-00f0-41a9-b7e9-45bb5a8778ba", "indicator--1707eed1-75d2-4ff0-90c1-48af8d482f04", "indicator--9d1dbd31-5184-496a-815d-f9777658dafc", "indicator--b65d0a7e-c482-477a-8d31-22279d0436b5", "indicator--ad47b9fc-c8f7-4bf9-88c1-f2410513ec3b", "indicator--2cad77fc-2bfe-4e42-a7b9-ff3382860a68", "indicator--cb0e84ef-729c-48a9-8842-8fc8f0c7923d", "indicator--f043610b-b6a4-41db-aca5-1baaa905c93a", "indicator--1dbc2dd4-1c91-4e11-a278-60c9c3bd8fc9", "indicator--804abef6-b26a-4683-8656-45a427259edf", "indicator--99614d30-a674-4a1a-8ddd-bdd663272e77", "indicator--c0a446a9-b3bc-49a4-966e-39de48e17ea3", "indicator--e59eb2d9-4728-4418-a4f1-785d6fbd4226", "indicator--49f728bc-9113-4c77-87f0-edc22c2830aa", "indicator--e9cecef5-92f0-44da-8d5a-22fc3a474e87", "indicator--e0d76e70-1c36-4f37-ac05-59a910cf7f27", "indicator--b7102e81-4e44-4d38-8ff0-8961735877cf", "indicator--8f26285b-c380-49c6-9275-915118c4ad61", "indicator--ea76c25d-a5e9-48e5-858f-a4fb42ce04d8", "indicator--1cf5554a-3002-4cd2-a4c0-c2e82da3fbac", "indicator--a519e729-9755-47ce-8c6b-be5a667a6acf", "indicator--7026a937-c642-4ad2-9163-37e03f86a7aa", "indicator--9dbf6b45-db8b-4f31-a541-02783d1baa9b", "indicator--e99e3031-5649-4b98-9324-4fbf96690d45", "indicator--1c4d9204-d32d-4d36-bbef-e0c70a790df6", "indicator--1926b33b-b31a-489d-97f2-ac3051baf793", "indicator--b6f78071-625b-4c04-92d7-7cdd6cdde463", "indicator--87d0ddc0-c774-4278-a737-09280df64a9c", "indicator--d4fdd335-1728-49c7-a949-b1e05eecab15", "indicator--fac8c74b-bb6f-4a16-8a35-b61729af6b2a", "indicator--dcd56d60-3643-47a1-ad7b-9f74fa15ed4e", "indicator--bac53ef3-64fe-4f10-a772-c94f8e95c550", "indicator--192903a9-0b07-40f7-80d8-848994418a23", "indicator--7bf15f84-5e14-4ace-8787-2b1e96a370ac", "indicator--6ca89535-fb4a-444a-aba7-f260a8d50c37", "indicator--d9b5db3e-bbf6-494f-93df-be20ad694551", "indicator--75ea1e47-36f2-4ca9-a532-39fc218d8970", "indicator--1a6dd351-0edd-4ec1-afcb-7b73201b5c60", "indicator--1e7727e6-2d6c-468e-a60b-facf8b0f0344", "indicator--4cdcc31a-fbbb-4088-91f2-c527c1b8ceea", "indicator--a14a7d4e-7886-4b89-994a-8fdf34cd38da", "indicator--8ef4d3f2-1323-4c1a-8180-1cf78ba4f16c", "indicator--c5a7016b-15d1-418b-829e-553ebc049d59", "indicator--09b1ae8d-64e5-42df-8601-21c839c99876", "indicator--6cfcba79-1110-4f95-85d8-2e386e63d338", "indicator--fd2e76b5-7260-43c6-abf8-7a31765a67d9", "indicator--444517e9-1676-4a9d-a911-7996cd1c5fe5", "indicator--c676af05-99c9-44a5-bfcd-442659a639aa", "indicator--02bb82bf-1dd9-4a98-b1d2-ef38da3ee901", "indicator--15c63a9c-4199-49e7-ba71-a246999b6469", "indicator--3216c20d-d6cb-4bd7-b473-185fcbf93518", "indicator--ad68e99d-5298-4a41-ad6e-bbdf986a9c6e", "indicator--0d208365-a778-4a47-9f74-971213156a1a", "indicator--c436f948-8da5-49bd-abc3-3ed9a02c40b0", "indicator--861a142a-59e0-42bf-800a-2e59ca398f29", "indicator--dd110ed9-9da1-431d-bc29-5ebe75fa3840", "indicator--ed85b953-6ba8-4cc1-b461-4c2c329d0354", "indicator--89f9cb36-07ea-4642-8757-a1a1a91fc06d", "indicator--ad850d8e-6da1-4427-9681-c6e5c26e496c", "indicator--04ca892f-e53d-402d-9bf4-c4f7417f2723", "indicator--8d146c15-563e-4508-a545-ec68e7abeb86", "indicator--87c7e47c-a2f8-4f38-9037-2605c91e4d01", "indicator--2bcce8ed-5bb0-4750-bd70-b75494c57862", "indicator--b6f7fd5e-f90e-4ee4-adb9-f250c7d5bf39", "sighting--bee593f1-cd33-4561-a779-9f505be6ae9f", "sighting--705caab7-ee5c-4def-9a0b-be3f1d308522", "sighting--0b0a02aa-1461-4d98-b52b-f35c36b8f2e2", "sighting--9eb19004-49c3-408b-8f29-0923092a8385", "sighting--bbd6e8d0-e8a0-4a4c-851d-554d35fb9c12", "sighting--403da486-e08d-45c5-a44b-7da10a8c6c48", "sighting--1ca8b7ab-6303-47fa-9173-492ac3168d6f", "sighting--232360ad-2e55-4350-9506-ea6afb940af6", "sighting--7e3da7f1-cb64-42e6-9b61-00e07136d530", "sighting--3624f9a7-e215-47b9-8448-f25d9461a266", "sighting--9dd52304-5a7a-4845-8767-4ec942f274d7", "sighting--4a829b6c-d5aa-4546-973a-86c80baab558", "sighting--719d8f64-f059-41cd-bd9e-a46d55784cf2", "sighting--b0e6e229-d0d3-461b-9806-f813adbed8c0", "sighting--222388f3-648b-483c-94c5-3a996159de52", "sighting--d80cddf2-3c4c-4008-b844-035aa0200bc6", "sighting--ac9a2f54-85be-4009-bc6f-2a226a92764b", "sighting--bda14aa7-e734-47d9-9c1a-6928f620685a", "sighting--affe80f0-bd80-46e4-8454-3b83aab5accf", "sighting--f79cb334-a862-44b1-ae3f-2b7486ec2b13", "sighting--128cdc42-3464-4d43-b25a-5498a970c16f", "sighting--5f38e509-e83a-4c03-83c9-00f54867abf3", "sighting--9c0c868e-6258-4d0c-8e7d-b501d8a013e1", "sighting--646b2f36-ba89-4ad3-b876-43c20e32c618", "sighting--7356fe64-6df2-4a8b-98e9-5b5c9e969534", "sighting--d1153101-c30b-462d-8971-096b2fe56779", "sighting--551b229c-700c-4f38-9c81-a3511161518e", "sighting--0e1712ee-d197-48a1-bf9c-76da78813164", "sighting--97d741e5-7bec-47f5-b0b7-9547ecc8c5a5", "sighting--ef2365e0-7576-4f40-98bf-abac16fda558", "sighting--0e063ecb-56ec-45f7-aa7f-f5a8d7c4a710", "sighting--41e6cb5f-09e0-43e9-bb45-1481f56e4f23", "sighting--a528353c-74d0-4048-9497-2491846b1dbf", "sighting--6c48938e-3d8e-43fa-a5c5-cf478576cd80", "sighting--ebe85f39-f012-4856-a33c-371e7841bbf3", "sighting--2d4dcdef-9bb7-4286-bb28-b35a5b6b1fc5", "sighting--f7d4369b-1a73-4154-8549-ea68e3f4a440", "sighting--8b5a2017-27d0-4ba6-a2b3-5acc1168e9e9", "sighting--2ab9ea48-305b-4661-90c9-dcae343bde53", "sighting--1e2118b5-c555-4ae9-abb3-eb9166f7f792", "sighting--2d14e519-b111-40a1-94e5-ced4f35b1b62", "sighting--dd4a7175-9d3f-4aeb-ab2e-999cd791a385", "sighting--e9fa2838-6e64-4845-b22b-3f0da72fd966", "sighting--bdd602c4-85ee-4fec-9b5f-16bc09dcae82", "sighting--67b52565-ba09-40be-bddf-b7b0e8dbcab1", "sighting--b544ddee-f942-4a79-a0a0-a69995aa32a6", "sighting--ebe5e921-de03-4463-951f-959ae9ed9471", "sighting--46159fba-d1b1-452b-bab8-b574c91a27a5", "sighting--59f5ee30-267e-44dc-a44b-a18d0df59ddf", "sighting--1a06c3d2-5a70-4aa8-8522-5b216373f13d", "sighting--c1784d6a-16d5-46b1-b445-d466b7c883b1", "sighting--c075c727-261d-4470-b6bb-800c72fa775f", "sighting--54c36217-216e-4491-9cf6-168326f3c0cd", "sighting--9ff1f811-fb9e-40ea-bfaa-820dc2bc7804", "sighting--21d5b5c8-c75b-40b5-8945-3657682aa0a8", "sighting--c415e278-5a04-4f6c-81e4-5711237251fa", "sighting--2598207b-b030-409d-a354-13cf99a30fb7", "sighting--0da81fb8-308b-4f51-8d7c-ce30883288a6", "sighting--d3250048-5181-4832-bcc8-982ef403d12f", "sighting--a75dca6b-755a-4d13-b877-04b1ad91fcd4", "sighting--5db046dc-e815-414d-861e-88b81ccb0704", "sighting--1b77a6e4-640b-48eb-9241-c3a586ab11a6", "sighting--f47efb5c-d3a9-4e90-90d6-9a5d3d4c04cc", "sighting--96904254-779d-4cf3-9582-d0c337b420f5", "sighting--7519f8f3-6cab-44b5-b3b9-d85d86d2457a", "sighting--5395862a-d50f-4481-a448-c2bdb0a8604f", "sighting--b8139c7c-bc63-45db-a1d9-e08c20859cae", "sighting--1c35b68a-ca11-473f-8490-7a7b2ad38069", "sighting--fbc495ef-66fa-476b-b70e-ea3911d86408", "sighting--8500fc5a-e88a-4864-9f67-bf3d010aa78b", "sighting--771f6090-06bc-4eea-8f82-d316edf00203", "sighting--0562cdda-0544-4bfb-86e9-2cac5ab16cb2", "sighting--93b55719-5ac9-4df6-a6e5-1527e063365b", "sighting--dad89292-f677-42d7-880d-db08d539d3d7", "sighting--02a2bd2b-0a17-4e7d-a3f9-0dc0a4fc59e3", "sighting--090bbe18-bb92-4f20-a6b5-bc600036f588", "sighting--b2c00286-e8b0-44fe-89ce-9246cff9cbd2", "sighting--22ac784d-5f03-427b-ba10-abf18f19c761", "sighting--554962cb-ad68-4cf7-8608-892944d64d3c", "sighting--c6bc6934-8358-44ca-84df-1af47cfcd4a7", "sighting--d78c6164-30b9-402f-82b5-185bbbfb6ded", "sighting--476e056c-e135-49be-9557-3197a8e24b9d", "sighting--6cb831a8-0a05-42c2-9015-5b6e68094889", "sighting--66860dfe-0687-4fe6-ab0b-fba9cde00546", "sighting--fe7f89fc-bc8a-49ca-9715-e6267c01f0fc", "sighting--107081f1-d5f8-426e-9276-cdba1bdd9e46", "sighting--82c0d54d-8507-488e-817f-113d29a6dc27", "sighting--1ac784b4-43ee-42e5-bb56-9113216ed8b2", "sighting--7d76835e-5c54-467a-af63-543ce4bd9d87", "sighting--091728d3-4eb5-4d9f-b22a-9e53e5e58449", "sighting--368ffe96-ffcc-45de-b4a3-0a2faccd439d", "sighting--38b1fcd9-91d2-48e0-a4f6-8b62ffb54c64", "sighting--0f15d825-8a56-40bf-a35f-017e1784569c", "sighting--2a410948-08de-4ea4-9b28-18090e38f453", "sighting--74694568-2be4-4f20-934e-86f7ff1b0744", "sighting--092dc2be-6a51-4efc-b4ab-fda4c28ab6d4", "sighting--7b7caa5a-b1a8-4521-ba4e-9e7cbeca2083", "sighting--1f0a22bd-bfd2-42e5-adf7-21ca2cbf4e43", "sighting--4bf2160c-0068-4c09-ad7d-d37304bf7b0c", "sighting--02fde658-d2dd-48f7-ba27-375bfe5604c6", "sighting--4cde33db-2d65-4b1e-aac0-f747d66fc2f3", "sighting--7ed5a51c-5a4b-4eed-8aab-0492bbb1f1d0", "sighting--6059f88a-896c-4263-9991-1f45b2950808", "sighting--c26dc2f0-6e0a-4948-b8cb-9e22b5ff1fb6", "sighting--06744972-9a4c-4cb3-97a5-0d02b4a986cf", "sighting--3535c05b-916d-4d59-829b-5a90d0b631c3", "sighting--dd579076-2555-4f5a-b26b-261360ca8a4c", "sighting--82f618dd-ca45-43b5-8ec9-8d471d3c7a09", "sighting--f82e5762-3cb1-40f0-ad09-6a4321476b48", "sighting--717dd1c0-f34d-406c-ba77-8cb5536bc9fb", "sighting--f6fd3bdd-27e6-43cb-ae97-1f529fc36c44", "sighting--172d04b0-4590-4705-a113-d4a9cfe970b8", "sighting--46146e91-da9d-4e9d-b782-0f3a71bae70a", "sighting--01f47583-a928-4f98-a3f4-e4c75b8c0e07", "sighting--82ed0480-47dc-4d2e-98e7-a1466d479af6", "sighting--d8d29339-ce83-4c2b-b959-89ae596b6809", "sighting--5673ae1a-9f1f-4af7-a5e4-c9807beb126d", "sighting--6fc20983-6b36-48fe-8ad9-682e89db4abe", "sighting--1dd47d3d-9298-4219-98e3-2308812c6534", "sighting--2091e4a1-acdb-4b37-a4da-8d71b70ec150", "sighting--cde2c434-95b1-435f-ad5b-b4dd10ba79bc", "sighting--5682095c-c8e5-4618-abb4-81faa9906bba", "sighting--b2251838-c506-4938-92db-99d464f2098f", "sighting--e60021b2-f520-4ffd-8e62-76ca763e4608", "sighting--85619a36-7142-485c-aba1-91e717b77f93", "sighting--0fc19e4e-cc4a-4672-bd6f-e452e26cd1a4", "sighting--50a4cbbc-8b48-459b-9c78-68db77a962e7", "sighting--898370d6-c5db-4323-bdf4-65eb1b161f2c", "sighting--ac9691b8-e1eb-4a69-b5de-09c158886977", "sighting--bda68803-ad5f-4cce-94e2-e8ea78aa9f78", "sighting--e3589c1e-8901-4f6e-a93b-28ad9d9e90bd", "sighting--237b4ba3-cb06-49ca-9fb9-ef5db1623c3b", "sighting--ae8b5a5a-427e-4518-90be-8cce74db19f3", "sighting--b6a01341-59a1-4292-acb2-b1c86b86039c", "sighting--98a08441-69ff-426b-8285-7f3f587deaff", "sighting--c6bc4f87-6cba-4b22-9c3e-cf6bcb3601e0", "sighting--96ac4b5d-1151-4689-be37-d46576304add", "sighting--16793b39-7eb0-4719-bfa4-1da3346a6545", "sighting--c705331f-3121-42a6-934d-a3076bda4e8a", "sighting--c7c655d7-d758-4765-b55b-991dbca7d163", "sighting--9b8576f4-a709-48d0-8861-e4195cc58992", "sighting--0db438f1-7488-4ad1-bcc4-397bb9575bfc", "sighting--cc23562e-c95d-4796-b177-d485887518ad", "sighting--37f73bca-1a72-45ef-89ea-db2782c660dd", "sighting--d86cc990-9ffa-4b10-870b-e8abb4f5acc3", "sighting--10653588-3320-488e-bbe6-c7b50b5a0fb6", "sighting--7f78a310-0c3c-488c-988e-14bd00ab9e79", "sighting--3d0e6c45-63d9-4e97-8206-ce4ce05254a2", "sighting--10a45529-fd2d-4833-ab49-6fcef07ecfc3", "sighting--c9025620-c202-487c-a257-b9f67f612d7e", "sighting--e840bcb6-6ad9-412e-82ef-2abae1358cf8", "sighting--31ad25ce-20e1-40e7-a727-bed41cb5d434", "sighting--1651e5a6-68eb-4646-830e-8b671cc63107", "sighting--4e20b668-de6d-49cf-9ae0-0431b28d97ff", "sighting--fb9355b0-4f7f-469d-9302-300dd525adda", "sighting--7b1f21a5-4130-4712-b486-d8b42fd0e544", "sighting--04d83534-695a-4223-acae-bdc81e5a8fc4", "sighting--d0b944c4-57d8-49da-8d4e-5bfdd7270cd3", "sighting--02a74c9b-329b-47ad-9d76-928a40e14f05", "sighting--369edb9c-6974-495e-a265-5bb45bf53231", "sighting--da8f4df2-3532-441a-af52-b8c044d0e31f", "sighting--feb4a608-75a9-48b4-a545-2dc639075755", "sighting--a31432ec-b5c7-4acc-91cb-d78f7568f47d", "sighting--94833f0e-03c8-4ea7-a520-e89451d20137", "sighting--61f4475a-202c-4e76-abc3-5aef509018d2", "sighting--033117e9-3159-41be-816f-86c966ac0fb8", "sighting--89a33632-0c77-4a25-935a-fe0c0a9f4723", "sighting--ce8f5d1f-a94b-4fe0-bdb5-d13ded84d1f0", "sighting--ed907de1-50a5-49df-8f6b-d38f2be608df", "sighting--b8c01221-3b7f-45fc-a7ad-f09131088b6d", "sighting--75212214-3022-484f-844a-ade9edcf0675", "sighting--4a6d2c3f-04bf-4e86-9cd2-b1d3deab84c0", "sighting--1e11a2b9-b45a-4106-be29-9710e3009a95", "sighting--5d9c82cf-acd3-4c9d-978b-eae69e3a733f", "sighting--3adcd29f-99ac-432f-a160-0ad642654052", "sighting--fadd3bc7-2584-49c8-967c-8e9b60886b26", "sighting--c1d26dd1-4dde-44a9-a46f-67cd63edab82", "sighting--e406278d-f230-4248-8422-044f1f4be978", "sighting--798e45a0-2046-4783-8380-1cce5635366f", "sighting--618af918-c383-48e2-bb74-e5e371c86d1c", "sighting--79681426-cc97-4745-9b8e-550f580ac885", "sighting--402659f2-d520-4f5a-80af-1d33bc63888f", "sighting--194d95af-6052-4185-ad8b-7c8cd5a7b0fa", "sighting--2d53f2b9-fc93-4343-a6f6-80c1ee3b184f", "sighting--5c6d8bbf-f8e1-410b-8b16-e447f4ee2d3d", "sighting--bfda8834-85bd-463a-805b-81e884379f67", "sighting--cf84631a-888f-46c8-8e7a-8f38ed7a5b69", "sighting--797e9844-fc9a-461f-9459-a2ad09fc4271", "sighting--b678e5d5-176a-4e74-8b58-8ed3ca3fbcd2", "sighting--bc84cdcc-c5b9-4ba2-a5c0-cb53706d24d3", "sighting--de664fd0-1e25-4da6-9216-77d9ab29f4ff", "sighting--8711574b-81cc-478c-b3af-cf486dfb6fd5", "sighting--c0a42f51-d2e8-4692-b3b3-652b23585014", "sighting--51fd019b-ca41-4e54-8eb0-e1e0e2c759dd", "sighting--025a3f0c-3dcf-42c5-9ad3-6ac534b7cf36", "sighting--c9c42db7-1e11-4d22-befd-577111fc1aa9", "sighting--c85e7136-4112-4305-a308-54a73f67f267", "sighting--4e4ea07b-ca9b-4b60-bae9-860d4413340a", "sighting--ab4dc99f-a57d-4a26-9288-6a421f74e8f3", "sighting--3dd5ffe7-4f60-44ca-8c67-d2f067ec4830", "sighting--3989721f-b470-4740-a20f-ee899f3f9df9", "sighting--1451b8d0-75fa-4d74-b808-f6be782358b8", "sighting--e48472c1-8bf4-4690-a431-bdf62cdf00fc", "sighting--d830a067-7ecc-4b1c-b0d6-e4b7acc546b5", "sighting--5ec5366a-90dc-4fad-bc13-35f1fb6dc5ae", "sighting--b51bb03d-ac77-406e-95e1-3652a835203b", "sighting--56c85edd-35a0-4936-9989-8aee1fd4b3da", "sighting--bca9e8fa-fe24-45c9-8beb-0bea6582d253", "sighting--051ae613-4577-4c39-9941-73a1593853eb", "sighting--1422d599-592a-450b-a6bb-facc9addc76f", "sighting--4fb19ed1-ac05-43ca-aa7c-006409928891", "sighting--f46b2e4e-786e-40ff-9bf3-fda72f9f2bed", "sighting--aa3b7d9e-f0ed-4bf3-8a0d-71e1d7293639", "sighting--672872d2-7c7f-4e29-bf76-8b7526acc46d", "sighting--2a52d03b-fa92-44a6-908d-aec293c86161", "sighting--0a1b7dd1-a2bf-4df8-985d-ba60d6a85696", "sighting--69818e4d-f85e-4377-820d-d9ab857f762f", "sighting--e8c61c28-ae86-45c2-8a80-47ef044442ce", "sighting--f2720680-f16d-40cd-8a96-9ec597e1d3af", "sighting--6e98b60a-69aa-4744-a707-0441c0accf7b", "sighting--b9937701-cdc0-4f58-9bf2-21e29dc231f9", "sighting--9346e2ec-778a-46a4-880c-fe3c56450c95", "sighting--03ccda9e-ad30-4821-8984-61f7650929a5", "sighting--f92ea43c-8e4a-4030-bb21-bc617272df86", "sighting--7e6a5ecf-1938-424a-8bd0-923a9cba6c4e", "sighting--0577e90e-9d8a-4deb-858b-cb157bb32343", "sighting--a447e595-2dd0-44bc-8d21-9b2787806d80", "sighting--fb31efb6-7829-4324-a4f1-e6775add716d", "sighting--84427457-fb0c-40f4-a2b2-f98c36752339", "sighting--b506eadf-fc77-4080-8ec6-b20fd6058b68", "sighting--a9ff75d4-4bc0-4ec6-9236-9979bd87f9a5", "sighting--ef9de45a-fde9-4d94-9870-8b817e9180fa", "sighting--c46ecbcf-07d5-4f8a-86b3-370d433791ad", "sighting--2cd255b7-c0af-45bb-b9b2-f31751cd42c9", "sighting--6d065e03-2935-4ea7-9d69-918d83705667", "sighting--78bcc408-3a63-4340-b3c0-1f80406b8c7b", "sighting--c3f5d890-cde3-4dbb-ab1c-39a0a278a495", "sighting--9225e1a0-5df6-4ea0-b795-5cef10329e82", "sighting--94969c0f-9e02-4b39-b6c5-61b0c437bd0c", "sighting--99eff197-dd8f-4797-ae81-926f3fbece22", "sighting--bb093588-f11f-4bf2-bfc1-aa9bbf37a7e1", "sighting--20ed7207-3e0c-4238-9a35-76cb36053282", "sighting--ffe363f0-ffe2-41be-8544-e8d93c55cb7c", "sighting--90035ac5-8ce8-452a-9c5a-457eb68a04df", "sighting--db88da14-409d-440d-8c32-1293b4db3b00", "sighting--0fe1ae1d-ec22-4579-a82e-15ce41aaab55", "sighting--53dc5d5b-6ad8-4878-b71b-1c5f7370aab0", "sighting--8a282aff-3de6-4c6a-b676-1158a7e9ac9b", "sighting--b7aebd7e-e8ca-4125-94a9-9589356ddc87", "sighting--bda9f435-2a15-4cbe-b667-22d48f2c4a41", "sighting--7e7f5f7e-9acd-4b58-a9cf-e0b308966a22", "sighting--0c10f79a-7d33-4923-a6ef-5cd1ee87ca47", "sighting--79a507aa-3560-4d03-be97-f51d393a2ff1", "sighting--a6eb83da-4832-45d2-abcf-e60e870b3d3f", "sighting--c542c18c-e5c0-4e7f-82c3-64f9c1c6a393", "sighting--591bf6fd-ed5f-40b5-9ea7-2b6b41f34125", "sighting--1df1afe8-cb87-4886-a1b9-05f44631f953", "sighting--c92b318b-352d-40d2-a314-05539d494408", "sighting--6181d81c-8919-447e-aa76-267567762acd", "sighting--e56fe781-01ef-4904-ba71-b86d6c0eabc7", "sighting--e9caafee-b24f-4280-8f6e-366bba7d803f", "sighting--6e922578-9468-4b9a-9aea-5be9bb78d4d7", "sighting--9621ce80-7c9b-47fd-b169-831ec77ed6f8", "sighting--a0c8e108-4735-4ed9-8928-49dfa523e906", "sighting--69556e18-af98-431f-b1ae-20cb94c18fb1", "sighting--3cf845b5-30f5-47fc-bc6d-6b7937b82f4a", "sighting--9294e4cc-206b-4f05-8eda-a22446ac861f", "sighting--b7833c48-11bb-4eca-8312-4b88a33f328b", "sighting--72c9de92-715e-4bec-849c-e96888a694d1", "sighting--0cd29033-b14b-4994-8661-a553a90074e5", "sighting--99ac5943-8e4f-4650-b96a-fbdfd33836b8", "sighting--f2211e37-9b25-4877-9cf0-7c2d14f7f400", "sighting--39908da0-509d-4dd2-a85a-70dd2a384f34", "sighting--0a88da7e-86e0-4ed6-a05e-fae4d739136f", "sighting--33b1e3cf-a271-4c25-a701-f1957f720dba", "sighting--0e447957-3b46-4cb9-ac84-2742936fcb63", "sighting--34cebe2e-4b56-4455-a00b-c59223be4862", "sighting--dee58e20-159c-44fb-b695-6e5e76f5296d", "sighting--5da5f32d-d595-4782-ab8b-664645385cd6", "sighting--b121bb67-9d5d-48fa-8abc-b8638cab6ebc", "sighting--196f6806-a1a0-4d66-b292-f9f16314f442", "sighting--48e2e2e3-1294-4cee-b68f-4bcba2effef3", "sighting--a1173e8e-1ba4-4214-a354-09e7ed13e1b2", "sighting--277fa000-9b73-4341-b951-4e1e4b832439", "sighting--157fea88-73b7-44ce-b3fc-474f50b63fb7", "sighting--0504f575-73d5-4e67-bdb8-a3598bf91abe", "sighting--db76d754-ce6a-4697-8a52-b151fc7fb925", "sighting--bfb72d8c-418f-4bec-b5cd-148006db2279", "sighting--b5d232b2-52ca-4e64-8d0c-1a2142417be3", "sighting--6fe501d4-2747-41eb-a148-710e3a05513f", "sighting--8333e300-bf11-4827-881b-f1b6e296e9da", "sighting--52b51dc4-26dc-4411-ab96-aeb67f1c5be1", "sighting--fa277e5a-15db-4b0a-b007-6cff28a2aed3", "sighting--e2e67771-c2d3-4ef7-8540-9b4f5cdbcaff", "sighting--ef011859-9351-4bd3-bf0b-8ab94adc3cb9", "sighting--4b133445-d8a0-485e-9141-d1c3003ba9e7", "sighting--70a84dfb-fa96-427e-8628-0c8a915492c7", "sighting--cc9e7ccd-5da8-4dbf-8671-a11b2766d893", "sighting--165e916b-27e7-438e-9e92-903f8a06b430", "sighting--7344da9f-c967-4d4c-98d5-47d8278569c8", "sighting--049b670b-2d5c-4668-ab88-2169bf8ce985", "sighting--0eece6fe-b23e-405d-994f-3c6c54cd64c1", "sighting--6e3282c5-800e-4e59-aa44-c0e2f299eb42", "sighting--c29ccc33-44bc-4d60-a25b-7335a2a9a75e", "sighting--ba2bfe39-7235-444f-b025-0c594142ba12", "sighting--cfe19b66-e62f-4c34-af00-8fd41d8e4184", "sighting--c844b897-5e33-4c95-8a99-75c3dd0a6238", "sighting--837a697d-bbe8-4183-9a79-06eabd4eaf60", "sighting--b882edd4-93f1-4078-89d5-fce4c0428ade", "sighting--069ef00c-38ec-49c3-8916-e04abfbe0d39", "sighting--b207bf0a-16f2-493e-b20c-920d1f6392ba", "sighting--9bbed4aa-fee4-4c1b-ac03-92cf1dee11b8", "sighting--0c13d08a-2bac-4718-a685-3b34ca278a8f", "sighting--26eb5b04-b7b7-41fd-a6ae-56d13155eaf0", "sighting--0f32b609-f2db-4122-861b-51357f602d55", "sighting--57011199-09f3-4a9b-9aca-f92bc32b898e", "sighting--3634d2f3-83e4-4902-91c7-db043997a20b", "sighting--cf5d2f1b-3c12-49e8-b8c2-37f71084eb15", "sighting--a8e1b95a-ccd2-4ef0-ae08-d3b79537afc1", "sighting--68506a3f-395c-41cf-b036-2619c05a6437", "sighting--acd6fd8b-44f2-430b-9087-61399e175a35", "sighting--890f928e-9a1a-4f2b-a095-b07c1391d119", "sighting--a9548b9b-47ad-43c2-92a7-ce6f4b2fdcde", "sighting--7ea8c212-c7e0-4b3b-b01c-a5c40b8881c1", "sighting--bcab9a27-8de2-41f0-b385-3c7d17bdc54c", "sighting--121e1113-42a0-4b07-bd52-c3625ffb9b67", "sighting--32092e0b-4b65-4bd0-a306-b588bdb1beb3", "sighting--cf313a4b-a9ce-4efc-bbdc-865611d7a446", "sighting--002b79bb-7381-490f-935c-f4c90c850812", "sighting--e1e73722-80b6-4706-8b8e-d570649b0285", "sighting--38d04c48-745d-4a9a-b45b-e38bc4b2933e", "sighting--ce0f5fec-b742-4743-8a1d-0e5f3678855c", "sighting--ef4b2199-c7c7-4009-9174-875a6bb5b8a8", "sighting--f30f69d5-dc2e-44bd-bda5-0a61204a3e97", "sighting--8424f15c-66f4-4a67-b6d0-0170d20120c5", "sighting--cc197a15-864b-40f7-a2cd-71974a0f2dac", "sighting--f83ecd07-72f8-43a9-9780-39761cd3226d", "sighting--85c1b436-bb3a-4065-8e7b-e096e57543ff", "sighting--78f4512f-f65e-4362-a314-5c0409077105", "sighting--20d729dd-d78c-4872-8128-d49e005b3991", "sighting--683d3259-2a86-4d89-a0c4-53f2bbb6d1ea", "sighting--08e409fc-c474-42db-b3b3-875fc139fc79", "sighting--91525ce8-c06f-4ba5-964a-f2a74ddb8b48", "sighting--66553afa-1ab1-48c3-ae0c-8edd21688655", "sighting--30be8e7d-cbf8-476b-8a94-da8248b98665", "sighting--0e7f4a12-624b-4a62-bce7-2c9b36fdb0f0", "sighting--447af290-4fee-44a1-93dc-9a81549078c6", "sighting--95527f1e-04f2-44a1-8d33-ba69e7ccb0cc", "sighting--8ef243bb-65ab-42d7-b4e9-2b01c4f34a27", "sighting--1d247322-f33b-4ab8-8221-6eeb65112690", "sighting--bae682cc-c75b-4b80-ad5a-c720e8cf8e4b", "sighting--9957176d-8886-460e-a5bd-e68929be50a9", "sighting--90c02cbc-3fc9-48f6-95b7-e84c22638bfc", "sighting--a0d2fedc-ce15-44df-aa49-1f7cae478515", "sighting--f41c3198-955f-4a6c-a532-4407b81f18a1", "sighting--90a23a25-a8d2-41e8-a61f-6b0aef6fb4c0", "sighting--6951ddfa-8460-4b81-adbc-2fe74e95425f", "sighting--32118d12-4584-46d7-94fd-f255f28286c9", "sighting--1c8cdf42-c1ca-49ce-a329-96c87c85a8a9", "sighting--e4d32e94-d6c0-41c6-9813-1dc6fb08415b", "sighting--b74b95d3-4806-47b2-867b-a26c7534671e", "sighting--2d03ef4d-6945-47d1-8528-f0775b8c06f9", "sighting--dd99ffdb-09ee-44f4-8a5e-6d8a69bbde03", "sighting--ab6b28be-ff01-4593-8b36-e5a738ec2a95", "sighting--d6ec975b-4801-4df5-88be-a00276346275", "sighting--7af87914-9606-4acf-bc2b-f3df793d065e", "sighting--5553ffa8-7289-4557-b49a-2517e4436b19", "sighting--4356aa2b-0e82-45a1-8611-0139b1a3a642", "sighting--a71f2ff4-03be-40ca-b16c-f1695fbae3cd", "sighting--a772cb4c-96cc-4586-9069-39afacd6bd0b", "sighting--af3f2ea1-e1a5-4f57-ab7d-076ab49bda07", "sighting--08b1f4c8-e900-48ba-82c5-7c3fc1e671a6", "sighting--f6877f1b-a338-47ab-940c-81568b7942dd", "sighting--6f0763da-07bd-496f-ab03-0f4d0fbd9976", "sighting--950c417b-00aa-42e3-93bd-1ff9149dadaa", "sighting--fe9d3f86-2326-42a9-a4d2-69989e7942da", "sighting--11dbb42e-51c9-4ff3-9827-599be06cd6e5", "sighting--5d8280bd-5d88-4a32-8c73-70cd230998da", "sighting--49aafc19-8875-497d-8a13-10edee6ed19b", "sighting--3f2cfdc2-8446-4f57-af3b-abee0ee7c5fb", "sighting--29621ead-64d8-4392-a59a-79afb408b0ec", "sighting--0a157ab9-1fde-47c6-9d65-0bdd5da33a98", "sighting--a925843a-802d-4486-9137-3039054e2dd4", "sighting--381e5dd9-15f1-4539-b484-e8abdd3e7aaa", "sighting--e90daeb6-81ec-4cf4-b262-e511c906b110", "sighting--5cd326de-7789-4c99-ab9a-5c1f7f182a92", "sighting--7f0ea222-e1ce-4e95-b77d-ae19cccb63b1", "sighting--6b224992-abc1-4d5a-a624-68b51d4b0da6", "sighting--4809f9ae-d253-4143-b0e6-66b976c0a79a", "sighting--3d38cd6a-51d7-4a0a-95f3-33c9104b81d7", "sighting--80212932-3924-4d35-b61e-9a6b8523451f", "sighting--97f4a043-29e6-4e4d-a253-a582d364eb39", "sighting--ee90e9de-5344-4d51-8a1f-7fa281b73d4a", "sighting--ac42f300-fcc4-4a96-8e50-419599d6f92e", "sighting--44c920e9-0789-4433-b71e-da98b22348cc", "sighting--9bcefa92-4dcd-4a8d-9b85-0d4521f6731f", "sighting--d86249d9-2bfb-47c3-9b94-0450ed66d32e", "sighting--bb4e7e4a-b790-4241-9404-48ac70f884d8", "sighting--88a55af2-ea23-4f92-959f-82c4ef8682b5", "sighting--2ab68716-76fa-4235-b49a-9a10acbf252e", "sighting--a1220dfb-3ec2-44eb-8280-fafd3bf532e2", "sighting--f238ce6d-66b5-450a-85f9-969d2f85ffba", "sighting--f46c8fe3-d4af-4c3c-af62-f0ded36bbee2", "sighting--6b3a69e6-14fd-4ca0-bc4a-3d4c0ca3195d", "sighting--bd6ce3e7-e729-4aa2-b990-97d23975b77f", "sighting--674d275d-a43f-4202-b231-0b8998c5371e", "sighting--7a819409-6a0e-4420-9a98-94c5200537bf", "sighting--dd172dbf-a72e-4928-855d-7260e77bedd1", "sighting--c01c8841-d1da-4fb5-a12c-2fafe2b9e6fb", "sighting--49c2128c-d457-4def-9149-44c5fb3358a6", "sighting--d4d2be1d-1986-4c1c-8a4b-35e0193b6980", "sighting--1c048418-0847-4946-b577-0e26e01650be", "sighting--67275a45-d50d-4ce5-b9a7-63dd3e8f5c62", "sighting--d7b0acd0-8c11-4be2-b5f7-76a823b5b3f8", "sighting--fe465709-7d03-4d65-9a21-8dc9b6a26808", "sighting--cfa77e12-dd4b-4ac0-b3c1-991b26b1dc57", "sighting--1dfa0e9c-14e1-439f-a42e-88c4f1a45339", "sighting--42574357-a84c-476f-ae11-1a55bc1d7e10", "sighting--5a07abc9-8843-4a93-a190-43192316fc66", "sighting--c9fefb0f-d872-4d72-bace-3435d248fc7e", "sighting--81e0bf3c-f983-4519-b8b3-2b923180b746", "sighting--e1312aa6-a180-4fc5-9a37-83d55f07d625", "sighting--c481f942-3005-44e2-a826-9bbe7f486dcb", "sighting--a2d9fcb3-db7f-43aa-9bfc-46227bf795d2", "sighting--4b033760-a770-41ac-9257-9fe507985a91", "sighting--cab99325-6429-44b1-9539-bf3b7f00c35b", "sighting--b60feb4a-d294-436f-8920-52ee12480416", "sighting--e506cd5e-7db7-4593-88e9-85db63a39ca8", "sighting--4606f75b-27d9-4f53-ac14-19ce9937b7e2", "sighting--3f68c370-0288-4306-a568-bba5e58ac89a", "sighting--5109a8b2-5040-464c-961d-64769d23a0c9", "sighting--2206465a-3533-489d-9bd5-fb30ee707c47", "sighting--1db51482-a524-4f65-bc62-db49b054b5e2", "sighting--c12070e8-c57e-40d4-a07c-02ea16fb0ba2", "sighting--6cd229c7-c7f0-400d-8aba-6b35b552c5a7", "sighting--28de719c-f933-4a17-b641-ded5b013d6d8", "sighting--39792d0b-e00b-46fd-8a55-db21fcda8447", "sighting--9f6e224d-15b6-4f4f-b4ee-bbb034329599", "sighting--59061567-7d12-4334-a9b7-a78317671b73", "sighting--cf2ddc4b-b106-4104-89c3-6a3ed1c4d379", "sighting--ac7da7ca-49ce-4787-a93a-e840f286ed70", "sighting--0281012d-3eef-4781-bc7f-446028435e3b", "sighting--4ae8d29b-01cc-4bd5-9145-961ebedd306e", "sighting--bad8c996-d955-457b-8167-3047e7534f67", "sighting--cac0cc8e-2885-4e35-8dba-d8d3197fbcad", "sighting--742bc96e-afdc-4ab9-9e6e-82370dbf16be", "sighting--b65abce3-e8dd-4da6-917d-e23c3ba38f0e", "sighting--5bf1bc54-7bc4-4f6e-bfb6-c87c43c64425", "sighting--12288c74-f977-42da-9248-d16a117c0213", "sighting--eee21737-5851-4b6e-b1a1-42f826d1ac1a", "sighting--36f50a1a-c0b3-427c-aa09-fcbcae6f6980", "sighting--5c735988-b36a-4af3-92f6-1e7cabbb510c", "sighting--08f7d5d8-bd9d-42d0-a133-2f774bc93436", "sighting--d3748199-7e56-4e38-8b5b-b2b7d60c0b66", "sighting--a71b9d60-d7fc-4a99-b00d-f6faa405cc4e", "sighting--bc2987f9-2ae8-498a-92b1-ecb9e91bff0e", "sighting--99d6d05c-0773-45e1-b37f-74da829a8c67", "sighting--2cf6d233-ea84-432d-86f9-bf4886ebdb87", "sighting--c2ca1b1f-2580-40f6-80e5-035a91224fa9", "sighting--a37f2873-fea8-49cf-b356-a45ab6d92a4a", "sighting--81c8dc3f-01a1-4d2d-8e8a-344fbdf470aa", "sighting--8d090c3c-4aa2-4a93-8ec6-7172f09d55c5", "sighting--7a83cf30-242a-4d33-85d5-9030e64cd851", "sighting--cde7e742-8ebb-4b1e-b47e-9dee9ebd6b38", "sighting--03bd2b71-c173-440f-b408-c966cc0b4f52", "sighting--2ffee6cf-43a7-4b18-8a5a-79c9e722c4ea", "sighting--1cbfe734-7d9a-4822-8f67-ab52a512acfd", "sighting--b37898a3-280c-4cae-a809-2e1108d8584b", "sighting--bcaf5e5a-ffdb-4968-87a7-f3969486c54b", "sighting--f8f0159e-ca64-49a9-90aa-cae4c7df56d4", "sighting--77fc4f56-ae87-474f-9e4f-298f8d073b96", "sighting--8cd19320-c3b2-4108-8146-fadb52df7916", "sighting--08af881d-661e-4be3-bc52-bf868abeddf1", "sighting--6efd4d9a-052a-449e-b44b-2bbc9df1efc4", "sighting--378ed8f4-f977-4892-984a-d91b2b4a8645", "sighting--87efef19-0122-4e56-a310-8871f8f9ecf6", "sighting--4cb42590-6191-4d17-8d82-3c7a1d4e2292", "sighting--8f1c0eab-c263-4db9-be35-8cefaa4f724a", "sighting--ea9c0052-13cc-4e5a-bef7-6716191a2258", "sighting--5ed5d50c-4d6f-4ea8-9252-31a003b11b01", "sighting--874c91ed-1190-4fd9-8015-df556436527e", "sighting--c4efdbf8-db63-41ab-9653-d9f07ea0ea4d", "sighting--0638df6f-76f4-4997-b8d7-01bb6cb73198", "sighting--0d4b1efd-cc51-448f-a309-c824e6474058", "sighting--cfc40b8e-f53d-48c1-8f2a-2e609dd814ed", "sighting--1a3d1583-b935-4151-a8bf-2decd05257ec", "sighting--a8c95292-41c8-4871-a165-b068a126a197", "sighting--12325560-bc66-4924-beae-d77ae32cfec1", "sighting--5f60c686-c8f5-47bd-ac76-c75aed9f28ea", "sighting--78d71e7a-1701-4a55-9942-17ae07b42489", "sighting--78c28eaa-596a-4fa0-b60e-1a950e347308", "sighting--9ff788fd-86d1-4b5a-991f-248b87c62b0e", "sighting--93629dd2-dd73-454c-b5f8-28f010e05089", "sighting--f3dee422-4686-4750-aef4-fc761c358b15", "sighting--1cf7ffe8-8b75-4590-a747-c474ebb39105", "sighting--8dd83e9c-1630-4f5a-87ee-abd0f70d685e", "sighting--872a2926-ecdb-4631-b30a-06959cdfcb9c", "sighting--a083712c-b547-4317-b07b-b51162605e5e", "sighting--c7b8bdd7-8b51-4931-b4bf-394e790242d4", "sighting--d3c978cb-5959-4e22-8e09-d1b956f5ba13", "sighting--c53b0411-f886-41cd-a960-4ea000a66421", "sighting--a1260dc0-4308-4565-bbef-28527c093f46", "sighting--34118ced-842d-4761-be85-e133f926f358", "sighting--7bae5b38-9ffe-4f2a-9ed9-8ea8cd333005", "sighting--f5c57712-da0b-4d3d-8d12-dcff8fcc0cdd", "sighting--4c7dba0b-b3c6-4ea0-845e-5b96194771f1", "sighting--c3be52ed-23ca-4ebd-bbc5-65c7902e4261", "sighting--64e7fdba-c4f6-4ff6-9bf3-8deb541c1080", "sighting--5c642049-3814-4391-8018-e014693eed07", "sighting--f05ab09e-fc85-4069-a664-5fb8b85254d8", "sighting--59d844eb-82ba-4d67-beac-e01579bd4289", "sighting--6a912d3e-c3f8-4bd8-a9b9-a03bb4f17267", "sighting--66459448-089f-4a95-819a-46498be8e5af", "sighting--6860bcf5-d008-429c-981f-4612d217309a", "sighting--24bce169-ed54-4bbe-a169-f8d75707e091", "sighting--035a1627-ea40-4b67-bdc8-52072f020a48", "sighting--81976fdc-48fb-4604-a801-ea7508cb7e7d", "sighting--4246e30a-5e93-4e8f-9426-89ff69d77ae1", "sighting--b20368e2-b18e-46ea-a013-7c43d9b7d6e5", "sighting--bbb43b0f-dd27-4de7-a1ce-6ceac811d685", "sighting--905d2c96-be85-4a92-90a3-7ee91f91b30c", "sighting--bae0426c-cab0-4819-a654-bfd898a144a8", "sighting--985531f6-ea6a-4ef0-8b87-6d6b1ad3b948", "sighting--3f0d84b7-1785-4c04-9488-b60faf51fac7", "sighting--afe18e89-f85e-4004-8d37-31fef69b19dc", "sighting--3f29bf5f-171d-4cd2-b0e8-161c72626408", "sighting--eafb22fd-55e3-4490-a2b1-93d417a03ea2", "sighting--5fc02432-6e83-4ba6-aed3-e4ee4b3bff62", "sighting--de01532d-aa35-43ad-8686-8591f9ec8c55", "sighting--81b482ba-a0bc-4c56-8115-b6688f80d1de", "sighting--b4d8e40c-d25e-4e6f-9349-7e7c39b3f387", "sighting--a38e3a40-87b9-4983-9baf-fe4e036e9c52", "sighting--2e1b72a9-1f06-4b8a-a76d-b34138eb210e", "sighting--ba3e4d34-1f44-4eb9-a5f0-db80d65b70ce", "sighting--9f7aa0b5-688f-4df5-8f1b-3f701705fded", "sighting--00b86272-e52e-4c5a-8e33-0a58a5a0aa0d", "sighting--cc8e9c8d-e3de-4a51-a587-beeb37853c48", "sighting--ebd7087c-65c4-4aab-b5a6-2c3754c9d205", "sighting--9e99b108-3cb0-4cbd-a6e0-52fa84b4474f", "sighting--2597689d-7056-4f8f-9296-2b84637e578e", "sighting--818c9748-bd8b-483f-abde-f2231e564e59", "sighting--bae4fa3d-efa0-4503-bc9f-c01018cb0e32", "sighting--f4b5dd75-a650-43e3-8928-22add21d6159", "sighting--d5023629-54c1-41c9-a99c-623087d94eff", "sighting--e8dfc2c1-b90e-4644-af6f-900aefb5f6c3", "sighting--b4dda8f8-56ed-4a29-b59b-b10bd4542863", "sighting--746e0479-1815-43c7-b71c-3ac421b38d71", "sighting--ee119482-00b0-47c3-bf68-1314a244be00", "sighting--e2a10367-0573-413a-91d4-8d2df35cc59e", "sighting--9f6b7e92-fd1c-47e4-9d74-047d0280af11", "sighting--94a688bc-800b-4087-a948-a46d56800665", "sighting--4a95008a-25f1-43bb-b86f-30ec0f179ce9", "sighting--78b2f4d8-f125-44ae-a103-38da10aaf94c", "sighting--8e76ca17-411c-4861-b1a8-71ac9740b8fc", "sighting--4bbb78aa-498d-44c0-bcb7-2c65cccefa15", "sighting--2074ceee-a6e4-46b5-8a04-b7300dc50c10", "sighting--e1835db8-5dde-4e32-a3eb-896b5456d3eb", "sighting--3a2dfa42-4a43-4341-84d7-38d4f8982ed8", "sighting--f6cca316-fa01-445a-958c-53b19064000c", "sighting--6e0e4001-d0e6-4a02-b260-af02a232074a", "sighting--667da0ae-7cf6-4abf-b90b-aef4d9009095", "sighting--c1e3437a-3e0f-4798-9e33-595fe09060ea", "sighting--cdd78e88-e61b-4550-b294-07d4c07aa85a", "sighting--e41e7bab-afa7-4033-9f3a-df592ab0fe36", "sighting--57cdac2a-f2aa-4983-86dc-34cbfa301906", "sighting--1e2fb028-06b7-4950-bccf-a1de4c9ae193", "sighting--9f85f6c3-b94d-4839-8af2-3244fc21fa58", "sighting--ce1192f3-feed-4350-ae16-3df23a529760", "sighting--46b5c5af-9b08-4c2e-8960-0e6042baaf8c", "sighting--d65af583-9473-47f8-8c74-f8c21ec63a7a", "sighting--dbaf66a8-15cd-41cb-a550-05d83020a0de", "sighting--21e4d784-b77f-4cd5-8164-71dedfc6e194", "sighting--f105ee63-f8ed-40e9-af09-04ec0a02ae10", "sighting--e20f9efc-e415-49bb-a592-834b57e0218d", "sighting--a37232e8-befc-4901-a8e7-cf71c018ac05", "sighting--dd6b246b-57a6-435d-b573-c7f869bfb969", "sighting--c32032d8-9a86-4cc1-acb0-d4d839dc7b9c", "sighting--68e49146-255c-47b9-aa47-b22e9e5ad5f8", "sighting--49c38fb2-2264-44f7-adff-7c95ebbbdf7e", "sighting--f00b6f49-cb0b-4eaf-be12-a419db99adce", "sighting--ee595e77-b1b0-4b5b-b4fe-8d474719a12a", "sighting--55bfcd4e-a00f-4456-b30f-9956fef4d071", "sighting--ece9deb9-a9d8-45bf-9b71-57f9ef4dcf54", "sighting--6afcefd6-cb44-42d9-908d-644e3fcdd9c0", "sighting--461c2367-b794-4618-9741-b73b655e1d98", "sighting--c4bd3bee-1e82-4763-b2dc-f732c71db06e", "sighting--004da7ac-08a2-43a9-8574-9987ee8739f2", "sighting--4baa8eaf-3624-49aa-9254-0126a2c106ea", "sighting--663c967f-64cc-4565-9707-7317abfcd8ff", "sighting--e1f7bb8b-c556-4866-bcf8-4a6fe075b567", "sighting--02446a6c-6b71-464b-aaef-ee0d16fbdbc1", "sighting--e472a407-e437-4bf1-a9a4-abe57de9d543", "sighting--e322b081-d59f-4fdb-8ea9-8625f61b02e3", "sighting--15e44603-acf8-4829-998d-ff0048a7792d", "sighting--d6ef56fb-1529-43cf-9747-b41b17027fb0", "sighting--d2fa9b94-313b-4cf3-8659-3bf86124044c", "sighting--571556da-c682-4dc2-aa77-21ffa957fc34", "sighting--886bc498-600a-47fd-acfb-d0f3567ff137", "sighting--0c130fca-9900-4275-90bf-3c0398e9732c", "sighting--f6bf60be-4a45-49ab-b9b6-520c98dc3a97", "sighting--4a0e0cfd-4f3f-41f9-aa66-4873e7d42147", "sighting--b0cb0d32-e8e6-4592-8b5d-2524899d1a71", "sighting--7118dd86-e0d9-478e-95ce-9e310e2a1659", "sighting--1bc9ec21-71fb-4df9-ab0e-8063242f254b", "sighting--02fc61d5-98e4-4882-944f-b863aefc9abd", "sighting--3cce99b2-9b08-46c4-bd82-d59ae6c474b7", "sighting--bcd3c34b-c993-4920-93ef-c6b9f70379bb", "sighting--34c81d1d-d548-4006-92db-61529743c23f", "sighting--25698d28-707e-42f1-95ac-a5fe985f381a", "sighting--1c1932c1-018b-45a8-9b8f-7e193cd54d04", "sighting--7afba58e-c60c-4945-85a8-c359bc9703a5", "sighting--2023f0a9-2d2c-4187-84da-059b7c16ef23", "sighting--4cef0e17-e0a1-467b-ab99-1d0acb61f6d8", "sighting--969c8a21-763e-4951-aee3-7122dcfb8bd0", "sighting--508d389d-c837-4977-a724-619dfa2de40a", "sighting--dd02476f-4afb-43f1-9eac-7011214b4726", "sighting--04d3ee4e-795c-40a5-89de-f2028e8640d1", "sighting--bd82cae5-ff3a-4579-acc5-3013ba8f9d6f", "sighting--e5a0055f-4349-44f8-8184-35fb7ead7854", "sighting--818ce9f2-942b-4f43-8a3c-76e42883f226", "sighting--35d06f17-fe6b-48c8-9875-37f67a3e0943", "sighting--4c52034b-7d81-4e42-9be2-e1e9d652564c", "sighting--9e8e3cd7-9df5-442f-830f-9b628a169488", "sighting--506f0465-4708-447c-aae2-fd8fcf0ba7fd", "sighting--e6ef7194-5455-45c9-b8d9-a4951a2eac45", "sighting--0dca36b8-bb3c-4c70-bd92-1fdfa4126bf6", "sighting--f6a23034-04bc-46c7-86d1-26d3e546e8b9", "sighting--452f40b3-94f6-4864-b865-31225d44176b", "sighting--f4c4424e-56d7-4817-9abf-5d989193223f", "sighting--692cafb2-db36-434e-9c2c-7cb0d9264939", "sighting--1af303d6-870e-45e5-b9fc-3bb9bab0e15a", "sighting--9db05867-1eaa-46bd-9894-dcc2366845f9", "sighting--65960288-e840-4344-bcee-b8fa8f191ead", "sighting--2733a559-c62c-40e1-98d1-92e61d5e2b6b", "sighting--9f0b6f75-ea83-4009-b5a0-013e13c3db0b", "sighting--8bcdfb82-782d-4437-838a-d182d070d3e2", "sighting--37bbca04-b125-4be0-b009-2e51e23f77ab", "sighting--b026ef2c-e227-4f45-8f2e-2ae63780dd22", "sighting--a59fb957-5000-41b9-9fbf-b572e188aa0e", "sighting--d4f3d0e5-b46e-4079-b228-00a3bde75d1e", "sighting--88083fd7-3c3c-43aa-b7f4-4fa61d398b7a", "sighting--7037bdb4-9001-4c66-8e76-199ac1089001", "sighting--76f1a674-50b3-4ddc-b00d-4e1852640d0c", "sighting--d42f7af2-afd9-4598-a295-0fa94fa10d7a", "sighting--90a85f23-f4c0-4fca-bd6a-e90c64299290", "sighting--8c1739c2-d0cf-438d-8e0f-2af648ed4a55", "sighting--b8d144ad-cb9a-485b-8257-ed1ff5109a2d", "sighting--8de0cade-adcc-4cb1-8dd5-7aa6eb8f9cc8", "sighting--2c3bba8f-1b47-4767-bc83-e9cbdfc9b225", "sighting--43b5013e-7a4c-4aad-9da7-e1c0e718021a", "sighting--36569a5a-10fa-4866-a9bf-443b9fb9e0e1", "sighting--a1774abe-be9c-408e-934f-26977d0ccdbe", "sighting--fa41e6c8-7b45-4ad7-87ac-935a130539c9", "sighting--f7812cd7-8f06-4ac7-9861-4477f9d3114b", "sighting--9880e437-5125-4a8a-9182-5508164f3c10", "sighting--ed02d3a2-7403-4aa4-825e-bb422f48b507", "sighting--b14f2ba9-96c6-41d6-8e2d-183484d1ff49", "sighting--33026429-241f-4896-adde-ef7db4131260", "sighting--f4805d66-b806-4805-a45e-59a8002c1245", "sighting--7c325cbc-7b47-4cc5-a0ba-fd7e2b51e49c", "sighting--877c977b-b515-4482-a6fe-b905e5a070b5", "sighting--e22647c1-d0f1-4c93-b35e-65558907e956", "sighting--3e09b636-186c-4764-ab9c-890305faf2d1", "sighting--97048ba4-9c32-4a33-bb4d-a4080a693db8", "sighting--0b368c9e-3e1d-439a-a424-2e370919db65", "sighting--df5bc393-babd-405d-ba98-8953e5b84738", "sighting--34474e5e-76bf-4079-869a-8aee063b5834", "sighting--795408ad-7d49-454d-b1bc-76013d4931f9", "sighting--ef6aeea9-8593-40e9-8673-f08500f289cf", "sighting--5e6f9a60-f0d2-467d-9450-3515e1233af9", "sighting--346f8db3-6d3e-4b29-99b7-4643f5aaebb3", "sighting--071eba6e-9161-45d1-933b-d26f1f3f81ee", "sighting--8d8b42b0-3234-4186-aab2-49bc7d527230", "sighting--2f9a7da1-5d0a-44e9-b003-ee9e0ce14932", "sighting--911e1397-7a56-422b-a36a-baa283cd2979", "sighting--eb5857f8-8704-4744-90b3-fca9f1a9fe6c", "sighting--06562875-e978-448d-9030-6bdfa4f0ba24", "sighting--77d4ceae-d9f8-4849-9988-5120fcb5640f", "sighting--6fa934a3-b66f-4616-9f2f-ed3717f27641", "sighting--67992cd6-5a03-4f20-b1c7-4454d5b3cab2", "sighting--01586f15-c9ea-42fb-a575-f1e53ce39c8e", "sighting--b35242ed-59ce-4b9c-95ae-ee1531eb5d5d", "sighting--aa25da65-7211-4448-9eae-6e7fe3b90ff4", "sighting--9130796b-1d97-4ed6-8ada-3a61bd00cbc4", "sighting--60626533-51f1-4943-b5fc-54503a42e9fb", "sighting--a0e1aa86-9fb2-4f01-9e55-fb8d76c50263", "sighting--f0b11903-1f28-40fa-8144-87f46b808bd6", "sighting--029677ba-beb1-4843-8ef7-e367d12b18d3", "sighting--247ca0bb-c545-431b-8e30-2be9eaab5911", "sighting--ae35981c-1b27-40fe-aea1-31171f695266", "sighting--a12a8a07-6810-4f98-ae0e-5854952a19dd", "sighting--a9dc95d1-6179-4194-b38c-23852b4f71ea", "sighting--17c0950b-e877-4cc3-8a3a-ebb224f12b55", "sighting--7faa23b1-31da-4bd3-8cc0-9a58376866c0", "sighting--b4132dc5-3867-4bc8-9426-a82d3362537d", "sighting--6decbf35-90bb-4b82-bfff-9f690ec45db8", "sighting--92200c16-0655-409e-9645-36e80493e52c", "sighting--bcb418e2-2302-4c03-aaad-a31644c9dc44", "sighting--7e1689e5-253f-43ec-93e2-b89778b1364f", "sighting--eb419cbb-dcda-457a-870d-2164200cf66d", "sighting--6fb46632-be23-4892-863c-b5907a354042", "sighting--8458ee79-d87b-4e1f-b8a0-bc94ca3d99ce", "sighting--9cee6117-ee33-4234-be41-d1ecfcabbebb", "sighting--ab40947a-7cb3-41cc-990b-0a287ef89fe5", "sighting--9bae3c4e-09bc-4da4-8e09-042c9dba2b43", "sighting--dceef058-6668-4f5c-8709-ead1bf979646", "sighting--27315064-4d84-46ac-b1e2-33b7f05c9c93", "sighting--685bd5da-3a7d-4dfb-a403-434edec5d31d", "sighting--ec6ea13c-fc80-4d86-b513-76cc0942fbf1", "sighting--892b1091-a522-45de-a5d1-586cf68bab0c", "sighting--fe0f709a-d91a-4c0d-acd6-ec9c4c4a116c", "sighting--3d0daf94-5306-4a97-a9dc-8d1ee3a0a9b2", "sighting--3addd7af-aeba-428d-9085-83386a7b148a", "sighting--c1869a83-9e16-4ecf-9fab-1d44ff09a8f0", "sighting--6135e6d1-169a-44bd-a397-2edce93ee3be", "sighting--bbc75b7f-c042-4480-b82c-25010a80395d", "sighting--9cf9cdae-ea83-4422-adfe-a41440ab3f0a", "sighting--ccefcff6-a3a0-4395-8503-23b2f7174523", "sighting--53646dbb-dda6-4c06-ab06-58d9596c3a08", "sighting--1e7b8d85-9be8-4954-b5e6-ecf946e3027b", "sighting--56e611d0-72bf-4696-a5fa-e02ad3f7e368", "sighting--a69f74e4-0798-4ee1-b247-f99e09bb56a0", "sighting--7f42620c-148f-44f4-9866-a2c10a45b162", "sighting--d1dd434f-e7cb-4a39-9880-5f75dde10389", "sighting--952cd577-9c90-4e0a-9545-fb53d1695c30", "sighting--9c4864f0-f7d1-47ee-88fd-afe9708b05f6", "sighting--6f4f2b55-9ec9-4777-b974-cff0f8ea0828", "sighting--8a4b48cc-1f24-4bc3-93dd-aa1489ad18cc", "sighting--68b033c4-cf7c-4260-845a-780763ddf20e", "sighting--e1ec9e81-66b6-41ed-9cf9-ba7f2eed8de1", "sighting--1f0c5a35-cabc-4109-8607-efd3d0c24f7b", "sighting--2250e8ea-f1b8-455d-8709-c08bf671b490", "sighting--0ddc2b61-eac7-494f-98ec-92f01a1aa54f", "sighting--47fc7403-7138-4079-8e4c-f94a54f2cdb9", "sighting--8573f132-98e7-4058-97f7-6b1ab068367c", "sighting--6bbee52b-eee6-4166-bc7d-47a82bb93a41", "sighting--d2238384-3dd4-44a1-af46-6d1973b637ea", "sighting--1c425f1c-c7b2-422b-b413-6d61f8893130", "sighting--c9a6f8e5-9bdb-491d-9a10-3b9f3538541a", "sighting--4e87b434-283f-4f42-b82b-12253828c624", "sighting--115a91f9-0079-4d92-86b9-3020d0b8d18a", "sighting--4166630b-64aa-442d-9bec-eee00ec711ba", "sighting--6659942a-74d8-46f2-8af7-219ac2d3d077", "sighting--d41414eb-dd95-47f7-9aec-a15ea9d7758d", "sighting--f0666f65-d419-4953-b13d-47f034265f3f", "sighting--667f5f41-1ac1-4fd7-9ddc-85dbb3be227b", "sighting--94fedd1b-c099-42cc-bb5e-c5e0eb470d65", "sighting--d4f35e38-854a-469b-a5a8-2c120ce21902", "sighting--5be50314-288b-4e64-ac15-3685bdb10733", "sighting--550e2a37-1eca-4c31-b5b0-31514fbdb198", "sighting--5c438e58-7f84-4f69-9693-239c0fca8178", "sighting--012892c6-8e58-4c2c-b1ab-9f0dfc57ac18", "sighting--2d2def60-e8b6-4b5f-9bc8-f66dc1f579d9", "sighting--e0979a11-0052-4266-9a1d-9d087043d026", "sighting--8c5ebc8c-5d09-41d9-b71a-e8d34498b830", "sighting--169a3355-831d-495c-9809-e3584aed6772", "sighting--15d1ee51-1c10-460c-91ff-0c10050c0f45", "sighting--919494ea-5ffa-4ce2-bc77-f26fbcbb1fe0", "sighting--81be2aa0-01f1-4be2-b591-b0ae01ed446f", "sighting--d3b58dee-a44c-4591-83e2-2c1ac7c1c1f5", "sighting--d0e01a2f-efad-4760-a0a1-d92789f342e1", "sighting--50e9c1c8-89a0-4b33-b685-25c153bfbf8e", "sighting--90ba75c7-f609-4f7a-a81f-4869ff1f8b76", "sighting--b28b08d4-96fc-471f-a0e0-f6f7a52cbd20", "sighting--5336a09e-3330-4cf0-84a7-6824347761f4", "sighting--3918b8c5-bab0-4286-a9c6-ce862ce161fc", "sighting--6552f16a-6c0a-4e98-945e-1dc4511af37a", "sighting--8ec1d483-7515-43b8-a810-c7e788273fb4", "sighting--9be3324a-d055-4fba-a420-5522d102a2cc", "sighting--915a2e15-c4d7-4cad-8570-e199985e637d", "sighting--fc6ee52a-e51d-4efe-906c-86346d5a3a1f", "sighting--7ffc1842-d6de-4f29-932a-486d59b9c698", "sighting--5c9cac03-50f0-42ff-a892-ff9811f518c6", "sighting--39729ac9-0795-4e27-9874-c764b429b2dd", "sighting--da3c23a5-8023-445d-89ff-404c65c034f2", "sighting--d51abf1b-eb0f-4514-b1b3-19760c5711b2", "sighting--abcdb078-a073-45b2-9b78-da7a383907db", "sighting--e9eec734-4490-420f-9e9e-7d39c1a0e185", "sighting--050a3741-30ea-470a-81b2-097cb55a91c2", "sighting--1cf3329c-c112-4e43-9462-479915fc0331", "sighting--e7546524-5fea-4cec-aa36-05437cbe4a7f", "sighting--abbcd317-df5a-4d13-ba8a-b9c1cd0da253", "sighting--f923fb8d-175e-4ee8-8bee-08fc3b9cce08", "sighting--d109c42f-0972-440c-9ee4-d30e6e2b3c00", "sighting--3bb34be7-05e8-4a4e-b89b-7384df2e6b76", "sighting--b40db294-0e5d-4696-8730-ad667646afa4", "sighting--e25fddcd-78aa-44b7-9b2a-1efca433bc56", "sighting--79ef528a-c4d6-4a69-b322-bdd3fcfaba6f", "sighting--82dafe88-6222-41a1-b04c-2a27e462e1e4", "sighting--61205a8e-5639-4f16-a0aa-e87bfe97b416", "sighting--34ec847a-b479-480d-b93b-dc7db8697bff", "sighting--4a51f520-1b9b-4c1e-8044-82ee087379c6", "sighting--d45cd7a6-3925-4c5f-a8f6-c0c10e8d1f4b", "sighting--83095690-71dc-4bb8-b65f-04ef0eedbde1", "sighting--fbc29e3a-aa92-41e1-97e5-8b208f320a63", "sighting--84647a59-a52c-4140-b15b-b5248146cf08", "sighting--4745f482-462a-4351-bc8e-ff60858d76a5", "sighting--034d31cc-5826-440f-aa2f-4a077eccfe4b", "sighting--f6e7872a-08b9-45d4-a36a-ca6808b5d1bf", "sighting--18ce903f-b96c-48c4-9a31-8b29d9f53c6e", "sighting--7d2d9fea-12cb-417a-9d4d-e3d990a8cc8d", "sighting--0dc3fb0e-4c4a-4a31-966f-279bedaa742a", "sighting--38f22245-8564-4a18-a20a-642e1b05a005", "sighting--f265daf2-8b1f-4e1e-9b92-9714e3006143", "sighting--10e01d7c-25e5-4243-be15-dbb22f88407f", "sighting--7b8eb536-5d1c-4c15-acdd-0ef43d5747ae", "sighting--0566e232-a38a-4394-b248-41ee34df0cf3", "sighting--12141157-ca29-429b-8e82-4479f2720fff", "sighting--4d7973ef-c5fd-4041-b807-004dd253aafc", "sighting--f3f9ca7b-554b-4153-9007-590f82e252c9", "sighting--df3b0251-69e1-463f-bc4f-fb051a619ead", "sighting--54acf64a-acaf-4ee8-8c71-4bafbed6f5ef", "sighting--492a7d4a-cb37-46ae-a772-e4dbb92f3ed7", "sighting--6a2e292d-710a-41b7-a2d6-6ca4a8ae28af", "sighting--30f42815-bfc9-4a00-996d-89d439cd600f", "sighting--ba3afc4d-fb5c-47dc-8e84-6d4674413f5f", "sighting--c31231eb-5fe3-4d3d-9b66-a9188663b66d", "sighting--92bd0143-00d1-4940-b570-24c4a290528c", "sighting--2655d9ae-6c7e-483b-bc5b-8de5fc19ad11", "sighting--bd5811e7-bf76-47ed-b10c-11daa562f8e8", "sighting--cc2c63c6-c5f3-4afd-a24c-d9ec034aa593", "sighting--11082bbe-b395-4696-bd75-98fe4feb9ebb", "sighting--3c1681b6-d8f7-4be7-8895-01854c6e434c", "sighting--9684ec93-309d-4bad-9241-1c3c831c2bf3", "sighting--63f4037e-0349-4897-8a73-72c3535bacb0", "sighting--f57160c2-b03f-42d8-bfc8-2854d13caaa9", "sighting--ee838c68-a443-48ba-947e-fa2826864d06", "sighting--07e5707d-86f4-49e2-89dd-f27a59997e47", "sighting--df05aa93-0737-4d9a-be45-a5c1fa1b5cdf", "sighting--98207958-eb50-448b-8555-73a25a375863", "sighting--2ded7fad-9568-4701-a7db-22d9910bf3b7", "sighting--2dd64953-fdbf-4af2-b3be-d04ad8c82efa", "sighting--903db579-d977-4210-8068-35668de0a97f", "sighting--0769a742-711e-47d2-afd8-d7fea92359dd", "sighting--c962eaa3-55d0-4d84-afcc-a32fbe7592ad", "sighting--2456fd32-3d50-44ad-b619-652632de3cd6", "sighting--c6f92228-948c-4bf8-83db-8917b79cb96b", "sighting--df842dd0-cd16-425c-9454-3dd32932feb5", "sighting--19a96089-a9fe-4d4a-8c61-be1774c5dbe6", "sighting--ff1bab71-aa5c-41f0-b18b-d8cdd896b7d5", "sighting--f11af2d7-7862-4ef0-b3de-37df8714f6c4", "sighting--29a26d86-1ce0-493a-8ede-8022fb9c9bbe", "sighting--dd05db08-88af-406d-af01-07bae11f868b", "sighting--b2d4cfe3-8122-48c9-8414-dd29c385c7a8", "sighting--29d7f2c0-8869-468a-8358-a3f51d03049f", "sighting--5d601895-7d07-405e-9b48-22120e6b7bcb", "sighting--df93ba52-857d-4368-a781-3a4ebbdb228b", "sighting--18a56840-9440-44c8-a823-9587a1ac9691", "sighting--cc1b2248-a3e6-4a90-927b-a0ceebb10fd9", "sighting--c82f7865-2e84-45a2-b861-cad3a5ede4da", "sighting--b4717796-39b3-43db-97cf-0582701f4a22", "sighting--b9f9a56e-57a1-4a6a-9387-f72843510eb2", "sighting--f31827c0-bb4d-4f0a-b2f7-e2752cc3aa0a", "sighting--5a4409cb-ea2e-4367-b8b8-507478fd7bbf", "sighting--812971b0-c2d2-4115-91a8-1a9889288f38", "sighting--0189ac8a-6923-44fd-a23e-4570061099ce", "sighting--38ce0627-bd46-4126-9cf3-a811db1a48b3", "sighting--f2d5f970-b133-44c6-9a31-de5c1953b922", "sighting--0c0ff5d7-57de-4bb2-8357-2bd6bc08697c", "sighting--429083b2-5623-495b-8fc0-35a377d1c186", "sighting--811d36bc-0d3d-4e4c-93f8-854b9589a7b0", "sighting--78fcd71a-5f89-4451-8610-6d81f1a29cff", "sighting--0f4cd255-2907-4578-9006-7dcdfdcce785", "sighting--1dcf60a9-41f3-4cba-bdbf-ca4d32188881", "sighting--5cf20217-c6b8-4f6c-848a-aa4330dd3879", "sighting--e85d98cd-1784-44ea-95b5-5bac4ea702cc", "sighting--52f2da61-89bd-40be-8073-9a411623d0f4", "sighting--5a00ff9f-8b3a-4c88-949e-5be03b1a1708", "sighting--b182ce4b-92c3-47fc-a8c9-14c07aa3e389", "sighting--e6cadb81-b91c-4378-95d8-a093f8aa0614", "sighting--fa667f8e-488d-416c-83a1-e4c6026f988d", "sighting--3ae35c95-f0ce-452c-9c9c-193198872d7f", "sighting--40c75552-3353-4ad3-9020-8b79a1ef0cce", "sighting--ef3e6b08-6595-40f1-8557-bbb6961efbb5", "sighting--e1247e50-5245-44d7-8f5c-8e50b854c046", "sighting--02c88a9d-b45c-4f6f-9eb0-74152b62e759", "sighting--733f6ae4-10fe-445f-9abe-9b0d8a3ddb4e", "sighting--cba2abf3-1775-46d1-ac39-65f22910f200", "sighting--76532f77-8edb-46d7-96b1-b4a9016c95e6", "sighting--99a1042b-2776-4156-84a0-80da047b527a", "sighting--3d6fa8f6-7dad-431d-82d4-56ef6e8e4a99", "sighting--34cdb12f-3468-4bf9-a5bb-1abb4b93b369", "sighting--7fcf62f0-19a4-4a88-9659-9f4575d55319", "sighting--f2814cbb-b8b9-4b0e-b238-c4bd7ec86ed3", "sighting--4c400319-5f6f-45af-8378-f7746c90c556", "sighting--fb37db00-9c76-4f80-a5b9-fe884ae42a8f", "sighting--655a8003-bdc1-438c-a12b-7383f23b5f6e", "sighting--dee7b6fd-1ef9-4936-8651-f4ecb9647d35", "sighting--d24fb9b9-a45d-4312-8328-de4c3dcdfb1c", "sighting--d5205c4d-38e8-4014-8570-5b93a9152441", "sighting--289f4233-1804-415f-be86-737a06b0bf12", "sighting--12de3105-1296-491a-9cc0-db30185d3142", "sighting--ed7a8204-1de2-47d5-a588-f76095e6d8b2", "sighting--0728a578-c6e8-49e9-ba35-9fc6fea6b92e", "sighting--72a15a17-ed3b-4113-b2ca-c897ee9db206", "sighting--b1cd3a01-048d-46a5-997a-a0a77eb0aacf", "sighting--1aeb07d1-ffe6-4f36-ac2b-b5920955f1ff", "sighting--6794c868-f7f8-4be8-9568-58692547dd64", "sighting--274ec3aa-0e2a-4f2b-a7c0-a484c11e8db7", "sighting--e47b7ff1-52df-4f60-976a-3c1d7697066b", "sighting--797a0561-1e6c-4dd3-818c-2b269d56a714", "sighting--ede49d96-4fe2-4b63-a0c5-12889653aba5", "sighting--1413aa0f-bd26-4c25-9cb1-4b37e322cef4", "sighting--75832f07-c49c-4ad9-869a-bdf07eaeb3e5", "sighting--fd793af9-1c01-441b-bf38-f06e7a283625", "sighting--a99b0a15-633d-425a-bf8b-fff7b283e56f", "sighting--d8a939f0-93ee-4d38-a256-00d42343455e", "sighting--79078165-27b4-4c7c-a041-19f8f5689bd7", "sighting--ad43efff-c9f3-48f5-a40d-2466717b3445", "sighting--a0c9f1ea-4c10-466b-aa5b-3ecf1213356e", "sighting--ac50af6c-0154-44ca-b8fd-a4bd9f9751a0", "sighting--11c9a5d1-b965-491c-acaa-304491140995", "sighting--9d75375c-04b1-4009-b909-e9b227813a29", "sighting--57fe1f56-cc1b-423a-8e98-fcfe65f0899d", "sighting--bbb4bcbd-6898-4463-a02e-5210c26b68e6", "sighting--c7c67d2d-df2a-4463-9e20-0c7de0c30cd1", "sighting--39b443dc-5143-47af-a883-428cdacae4d7", "sighting--1ccdd0fa-0439-4714-abbd-f2295b5e40ca", "sighting--08f769be-b918-4565-8fef-46845b2ffb9e", "sighting--309ff4f9-a925-497b-8ae3-5bbb6c4ce160", "sighting--5aebc544-159d-4ceb-957a-54120590d38b", "sighting--20b35c0c-606e-4d9f-914f-f03127ee4441", "sighting--2e723494-b3b7-42d2-b2d2-55c2184d90ab", "sighting--bbb3acd9-82b4-4d1c-b231-07c1701e77e6", "sighting--71d4ac78-c5b9-4d5a-bb9b-a57407155f4a", "sighting--ce4a66e0-4d42-490a-9c8b-b6a0ffe678c5", "sighting--af9a9ad6-d18f-4c8a-a353-8654b19e953f", "sighting--c3b76d74-87ab-4a73-b725-ffc2022963e9", "sighting--3d5de3c5-a5c1-4f92-8634-14781f008b5d", "sighting--c786d951-dc9e-4bb3-95fd-5d8a349f897a", "sighting--903fdfff-60e0-4e60-9b6b-c149c6bc759e", "sighting--d81916a2-161a-4df2-ae95-7adc8f5b3b86", "sighting--1e580888-abcb-4ca3-a9b4-3070e73a675c", "sighting--67b6c15e-d39a-4668-be11-81f20e757216", "sighting--50d94bbb-34ed-4818-8b61-47f80b47566d", "sighting--0bf80a37-8c75-4544-b5b7-51400f681e6f", "sighting--77ca9914-a386-4723-b107-06326fb6e3b2", "sighting--ebe3a77b-5eef-4f98-bae2-ce279764a8f4", "sighting--64bdbbf9-fa10-4997-9da9-b13364f3c29d", "sighting--c21acf54-735e-477e-96e2-a11f187dba24", "sighting--11159c2f-7c71-498a-951b-bce7bb2c8179", "sighting--1e2d30b9-e140-4465-9761-d9df3ce3e79a", "sighting--6b2339c5-f365-42e9-8ed8-b585c94f9884", "sighting--29c2dcba-e7d1-402c-9c74-6f82beb36ce1", "sighting--bb0b2798-9589-42d4-a497-e395d7d68151", "sighting--e3ae5a80-490c-4a19-9962-67dcda4f590f", "sighting--6013a231-3320-4400-a5bb-3048240d8f5b", "sighting--28ecce7b-3e35-4afa-9da7-aff168108bf9", "sighting--d9a3c4f0-5952-4668-bb1a-2dca4d591e0f", "sighting--4582480c-e9b3-4bf6-8158-b545add78b68", "sighting--8011b744-262b-4cda-811d-9e02ff14f253", "sighting--cf0f68b8-a3e3-4ef9-b25b-759c07c627b0", "sighting--ba375375-ce46-4fb6-a414-16a0e614f7ec", "sighting--c27ca35c-a2ef-465a-855b-e1a892aa40a3", "sighting--06c27688-f1aa-4b23-b03c-6d7a354112fa", "sighting--76805b16-c00c-4573-9cf1-3d8196fc957d", "sighting--01b024fa-b8ac-49e8-a0c5-68d3ac5d3f4c", "sighting--9eba835e-ac95-4b9b-ac20-bde05d8f6269", "sighting--a4d3b4b5-c35e-4b28-bd26-cea93b117530", "sighting--a124f033-adf4-4397-be86-b2ea453e9e3a", "sighting--7ff8eed0-ab21-4218-9170-798c365edf06", "sighting--172e822d-61ca-4b20-a429-044a961800fe", "sighting--6831bc46-ba53-4144-ab09-f6fb0d44c2ec", "sighting--a293627e-5820-42f3-b55b-bd25308b5f19", "sighting--923ba771-e9ba-4f6d-bf81-cf89435d2d91", "sighting--d793646b-1bdf-4f37-82b7-d4bc8787d0c7", "sighting--eb288c65-9bf3-47e3-8a13-acf2c7b65f8b", "sighting--9ae6104b-2d13-4602-9464-6693354d8eac", "sighting--60006e22-1afe-46de-a37a-4fb44a50a50b", "sighting--f8a18ac1-f8b2-4ae0-a9b4-d3921ef4c18b", "sighting--a02da12b-6f36-4e8a-b83d-5daf4b98cb2b", "sighting--bea36428-91c9-4fd7-98e3-f9fcff98dc47", "sighting--a3b44dcf-1400-44d5-ab22-e563c7b3e437", "sighting--9468bb0f-e9d9-4382-ab39-1ec8a303e2c6", "sighting--418bdd1e-0f4b-4301-a54a-e005e304335b", "sighting--9e60b36a-547f-4b85-87f4-b5e2f1543b71", "sighting--898af455-73f5-4956-a666-0a58421a7044", "sighting--10c5fabb-7cda-465d-ace6-e09ababb37a5", "sighting--d2da19f9-a074-4295-9075-e997c2e138be", "sighting--b0e3501d-ff9f-4353-b835-479c4d2c9a13", "sighting--0fcc6f0b-c427-4d2c-929e-1d801d207875", "sighting--4a4efde0-756c-46d7-b4b7-32218073596e", "sighting--477b5fae-f4cb-4fd3-8f64-0c65288b6532", "sighting--16154439-b1ce-45b0-9b5c-cdd479fbe238", "sighting--30396077-79c1-4aca-b2b5-b2fee9c6a4e9", "sighting--9d1be609-e5d6-47b8-bb85-d9228a9f4803", "sighting--c31974f6-66ae-4144-9925-4f00f91b5b6b", "sighting--03fee988-0b74-4084-b7b1-2997d365cfe3", "sighting--64492154-4a25-418d-a9c1-6a4b56a6544a", "sighting--f7cf743b-b69b-4d91-90ba-aae140ebe522", "sighting--5014a9b3-bec4-4242-a981-364b7ef69977", "sighting--14cd13c6-37a3-415c-8c40-7525c56cc209", "sighting--ab000832-4a85-41a1-9c1d-13a9cef385b7", "sighting--85dd57aa-7899-4b8d-851c-221655e0daa6", "sighting--b4bc392d-0b16-46aa-b2ba-9fe5a5b88104", "sighting--d54ee82a-8b51-4974-b820-42fb3b045418", "sighting--b5a84925-dd0a-4289-b26e-4c370a4c512b", "sighting--3adf6c7f-1fa0-411e-a6b7-04bf03386f30", "sighting--55f79d65-a024-480c-a3a5-5e8905d95f1f", "sighting--13f2e902-516c-41bb-8aea-7dd4f71f3b79", "sighting--dc890335-9f55-46e2-ab8a-603c6bd03a30", "sighting--6b99bafe-11a6-413a-9f68-8d908d14fceb", "sighting--94d6bd48-174e-47a2-a60e-d79bd27a61bb", "sighting--0f0ff944-7c99-4885-a0c4-991d5eaaaabc", "sighting--c72813bc-4a26-4e74-a41c-7eeb29621d1b", "sighting--64f72bf0-ebc6-4a3f-985f-554bff41efe4", "sighting--883a298e-091b-42e7-80db-cb81b01765a2", "sighting--69ceeb05-d4cd-4af0-9bbc-a372cadaf8c1", "sighting--735a7104-b1e3-4c4d-bc39-de854b5db868", "sighting--b4fab2e4-6223-404c-9caf-a66b55bb08d9", "sighting--469f3a8f-0878-4c19-89c3-90668c1b29c5", "sighting--dfbb898b-7a55-4e51-ae10-123a76b02c6b", "sighting--2a5b19c8-bc61-45f2-abf5-373ba5e978a0", "sighting--4e533294-c627-47fe-a32e-81af967c7b1d", "sighting--4fc60d5d-cb51-4899-996c-e6389062503c", "sighting--e666e5d7-29ee-4fc6-896a-aa844f0b2048", "sighting--f6393b70-20f1-4e55-8b48-1d4eab66d0a7", "sighting--6c14458f-7191-490c-a73d-54ab5be6e5d3", "sighting--f47ebdf6-ccb6-482f-917e-2609def235e7", "sighting--0eb9f9d5-5713-4ab8-8ac7-da71c63848ca", "sighting--5a69ff96-f6b5-4e6d-aac5-b05cfb191304", "sighting--22840279-2a4e-4f40-91d6-76f34f19dc4c", "sighting--5fd0732c-0aef-4ea6-a514-712d717b57be", "sighting--31736019-c85c-4161-bbdd-59fa885ba72c", "sighting--c8cf2495-66d1-419a-9710-23d466071c3b", "sighting--fa7d549a-872a-4cad-8d32-855c6ccc3b32", "sighting--41f9ea9d-7f18-4641-bc5d-468e3658874d", "sighting--3c65e131-2895-47c1-908c-cbc844aca6fc", "sighting--0c55ecb3-30a2-4b8a-b102-2a13dd0145f7", "sighting--0375a69d-2fd5-4489-86c0-1370f0cc5aa5", "sighting--ff78d361-5785-4616-a908-14b9605142a7", "sighting--b2362e70-9e83-4552-b26e-d74c7633364c", "sighting--83c0200b-709d-4fc8-bdab-bd15c607492a", "sighting--22f48fa3-1046-4f94-8322-20bcdebd0916", "sighting--29ccf2b8-25f6-46fb-9b53-24e0c7084fa9", "sighting--c4039acb-9439-4298-af36-f7b8d1a81751", "sighting--dfe5ad8d-da89-4b9d-812c-7b40087828af", "sighting--60f48046-813c-474e-af73-784632b57e01", "sighting--94dbdbea-18c5-4565-8eab-b6a74d0b8645", "sighting--48b72950-7c78-42ed-8cb0-787f50171b17", "sighting--330ddd17-0f05-4a6c-a304-95a4c3f769da", "sighting--9d6331bd-212d-4d22-90b5-9808161e8b09", "sighting--d4993f90-ff97-459f-9ae0-53b175509170", "sighting--a7769bfd-452d-4489-9977-5cb05a4d0d79", "sighting--cd2030dd-1d2f-4661-bdd5-85a4b7502785", "sighting--746b628a-c44e-4150-b01a-a858df6fbab3", "sighting--0b5c367a-c687-4015-b214-e2b2c6f378d7", "sighting--35e2ffe8-1725-4671-b7e3-4a0403ce5baf", "sighting--a379f24c-f050-4bf5-8624-75494b47e655", "sighting--12e6d50b-eb4b-4e6e-9c41-552b0bb0499d", "sighting--0096d3fc-56f7-45fe-818f-6985e65063c7", "sighting--cf4de10d-9ab3-43c8-890f-11b91f5635be", "sighting--97896e95-85eb-4d03-8987-98484e957b1d", "sighting--142867d8-9f6e-4440-bb03-000631d621b7", "sighting--fa26790f-724d-4d27-9502-35a583c58c07", "sighting--a6f8289a-7ded-46bc-a736-1f50f004bce6", "sighting--521028d2-c83b-4501-8498-937f2a38d263", "sighting--0b3d42d5-5113-400f-bd20-24840971fc32", "sighting--66febe70-e7ea-4c8b-93e7-2e99d152d6ef", "sighting--f06de4de-36dc-4779-9e84-a8b333a1e991", "sighting--f2d82200-97a1-4dfb-8ae3-20449fdbf3ee", "sighting--a959004e-57f1-442f-90ac-3a747c6b5d05", "sighting--a0f28f37-7211-4592-9d6a-26dc16914136", "sighting--314fd424-a2e6-466e-b6b0-c6f3d4a040f2", "sighting--d8b1fc84-d585-4112-ae7a-6c1e79cf3648", "sighting--755d6767-b03a-4e2f-8aad-d25bb7fd3e18", "sighting--732be193-70e4-4131-b191-4a72de633761", "sighting--e2a3ee0e-8cf9-4e6f-9795-a5d1d0ed3fbe", "sighting--305217b6-82e1-4fb9-9eb8-6760eb53fc99", "sighting--6f03de09-dccc-40bf-a382-ef2c1a40286e", "sighting--e98bca67-f8c7-4a84-98fc-84f6a605bf21", "sighting--c3074f8c-3b10-4d4d-96c3-c60a83126941", "sighting--8e74cef9-5390-438e-ab05-3fc4ad5f38aa", "sighting--cc042490-1fa1-40bd-a437-50d6f911c9d3", "sighting--78228628-258e-4b1a-9a33-330c9e80c4c3", "sighting--459f2268-8906-4f38-9a14-58c5d5b5dae1", "sighting--199088be-ebe5-48c5-8f95-33061eab106b", "sighting--6cf56cfc-a363-4c64-9023-619673a166e1", "sighting--1fbba2c2-e8da-41c8-abc6-6e9737c0e194", "sighting--5446d20a-ee11-4a4b-a813-cdb0da404bdd", "sighting--15f8dd3d-aa0f-4ae5-acec-38d8c4580170", "sighting--3b154d0e-0c2c-419c-83ef-b7e99b17f39b", "sighting--79f27f16-65a3-4fd9-a47a-46e5d4d01d0c", "sighting--32af472e-bb72-43ce-b3a6-4b4630361dfc", "sighting--a6a2b6c1-9d19-47a5-b895-26340fcce9de", "sighting--d8f358d7-3031-4fd6-a04f-beebe0e7967b", "sighting--53b2e659-7ffa-464e-8b92-8523c8f1195f", "sighting--ff7894b1-1fbf-43ab-b120-a650bd64e9ad", "sighting--5f0aace8-8fba-4f85-8dd3-dc1951736240", "sighting--91fa7c2f-b1fe-4f56-96ab-f41353580786", "sighting--96a65aba-b054-437e-8782-79a18683df9c", "sighting--cf93d236-c1bc-49f7-9466-31529003d773", "sighting--935a24bb-04ce-45e3-a8b8-7dfaa0b5b098", "sighting--5af9a114-2abf-4c21-899e-fcaea3326ade", "sighting--f701d5f9-a653-4660-b012-c040d6cd0228", "sighting--8442a625-633b-4048-ac0f-7d0b22e5f7e0", "sighting--117f37ae-c739-4c23-8a7a-01d84002e15a", "sighting--95b99584-a3b0-4e82-b555-55b921ec62c5", "sighting--49be80a0-463d-4125-9a14-3b989b425362", "sighting--8a9a72d8-97ca-4916-9cc9-2c94f96be5c4", "sighting--414bf8e6-d559-4e3b-89f2-fd0c87c802d3", "sighting--935aac35-4bcf-4f8a-91c3-6c5fe691b60a", "sighting--45ecb25e-84c3-4694-829e-14e70bb98205", "sighting--75019834-bcb0-40aa-a5da-daddf45fffcf", "sighting--8096bee6-815c-4bca-8141-1aaf3816f65e", "sighting--d6e33854-e0b7-4727-9ac1-d4cf6be3d2fc", "sighting--4958b7dc-ee14-47d6-b8fb-dbd999c605ce", "sighting--cd211008-77f3-46a0-bcc9-ff03085c224b", "sighting--9a8acd39-9d77-4ac4-8196-57dcf7b6e479", "sighting--9a8f5d6c-5782-462e-b340-f9235df6b76e", "sighting--67e63b80-4efe-453f-98ae-d9a2f392833b", "sighting--67cea329-2103-4492-af28-387199767a59", "sighting--aa60f947-81c9-4e9e-bcd8-957690422770", "sighting--44e5db33-2eae-44da-aeea-2dd831518d14", "sighting--5c82eeff-2680-4014-8802-e8519607fe7f", "sighting--6bbe5a2e-6103-4263-9cf8-ce925d5b0e1c", "sighting--d1466d0b-3f2f-4190-a411-4d2e3de1e496", "sighting--91cc76f6-dbed-4c98-960f-c258ae187e36", "sighting--dc8dfb9e-ee65-495f-a66a-e251289ab824", "sighting--dcb8c756-0810-4de2-801a-d3f8bc67c980", "sighting--ddaf85bb-eb8c-4665-95de-e733cacdcdc3", "sighting--b41c6db5-8d69-49cd-80e2-289e990918d6", "sighting--74c3f2e4-8751-4466-834f-b31c197b293e", "sighting--461e0a07-b13a-478d-8ae2-b61a67d7f577", "sighting--079db474-dc81-4c4b-840b-99e167e0fbdd", "sighting--3b5aee2b-7b45-435b-a513-c32beb6865e7", "sighting--28deddde-8cd5-4bae-8330-43c19e45cebb", "sighting--e2f99047-1490-4888-9f5d-7bc3a457eb77", "sighting--6d457171-dc5a-4132-8bc4-c0dc4643dd21", "sighting--218a1361-8f8f-4bc5-b518-89d370e7da45", "sighting--1cf67531-cf24-45ed-90b9-0145254e40e5", "sighting--2dad2fe0-e986-459e-9c5d-b7920ce44004", "sighting--38bc1f0e-3b86-459a-aec9-a7ffde879266", "sighting--8f2322cb-53df-4f6c-93b4-4c4d7bd74cac", "sighting--b30962a9-e193-4908-b165-32d8c3356cba", "sighting--fd6c9715-ec4b-444e-b420-ccb51c5d68e7", "sighting--a7535d50-044f-4c0e-b3d7-8da56f466a0b", "sighting--67cad7a8-e146-4f7d-a048-99b08f61202e", "sighting--73a0c1c6-0503-4705-a7ff-7355a0033c99", "sighting--504c14cb-275f-4ff8-b6ce-7fb44a957607", "sighting--b265b9e0-67a3-42c2-a56c-7f9bf0693330", "sighting--a48d4bc5-f0fd-4ede-9222-abf2b8385cf7", "sighting--67e83c9d-1672-464a-8832-1dcea7b149e6", "sighting--65d0f7b8-3c6e-4dfe-b6f4-ab130d57f29f", "sighting--b48b7b88-b06a-49f1-a68e-40169c03fb69", "sighting--34531a4f-bb09-4d04-ad27-e788f2284787", "sighting--9529c632-8491-4218-af71-e1547bd738a2", "sighting--b608c5a8-8c05-4b25-a7b0-329dd4006801", "sighting--d81b2ee0-028b-4b32-8e22-0a2083c0e779", "sighting--7c9ca8a6-fc10-4f96-b010-87cb03b48a95", "sighting--3c28a71b-3866-4810-9e49-f96924c06a92", "sighting--1f0992ed-a314-4a15-ad07-4815aa3917cf", "sighting--199cace0-5cba-4916-88b2-5817b493c6fb", "sighting--d00906ca-f273-48e0-aa68-04dac05f1cfd", "sighting--973b19ac-68c7-4400-86ac-8c862697d625", "sighting--89d53da2-a500-4736-b662-d17775013adc", "sighting--eec486c1-7e0c-4ada-b671-f3bda07a0b9b", "sighting--f4e54d0a-0c23-4cdb-8072-c17d08eaaf35", "sighting--d50f2eea-b802-4d63-83bd-d1ed2eac2cb8", "sighting--3670389d-c017-4e40-908d-5cbe80ab918f", "sighting--6fbdf7cb-f571-4ab5-9232-17bfa5ff80a5", "sighting--cadd50d0-c44d-4467-aa52-d1d162d6c29c", "sighting--b82b81b0-d96c-4ede-b5d4-04c1bc1f1803", "sighting--997a5eef-b979-4c42-b100-2302eeb6e5e6", "sighting--2db3baa6-bd38-46f9-a3a0-275e2138be54", "sighting--ae1b512f-0c92-4d27-ad9e-82e46373379b", "sighting--9e986834-b9c5-43b3-a73f-6fbcb825b3bc", "sighting--7b5c8f70-639f-4f01-9fc0-01d064b78fb6", "sighting--2cba0494-ea2c-4c6e-8e29-0ebd4d7ea156", "sighting--85b691a4-42e2-47bd-be8e-a6d864e0e0c4", "sighting--2203336a-ea61-40a2-b4ee-6d738f11e199", "sighting--5daa1935-1b75-4126-96e9-7d831a1b1df8", "sighting--b4b04366-b3a1-466a-8011-2418af770729", "sighting--0b4984c7-24d0-494d-a5c6-b1faa859b405", "sighting--c9c4ee29-38d0-4d5e-b654-4987f9af25dd", "sighting--630d49f6-0436-405a-b509-81068a5a46a5", "sighting--f8ade879-7c1b-402f-9592-97e3bfd1e01f", "sighting--58ea048d-0d88-4670-ac32-597df6eb053f", "sighting--86231a12-2827-4750-afa5-287d2fb7450d", "sighting--eb64e600-1a83-4e06-aa89-4366305d3ac1", "sighting--1316019c-7ec2-4a7e-84cb-9972ac9870cb", "sighting--10eab315-077d-4c54-92f2-8d6c8f49fbc5", "sighting--6b998604-9a7b-47fd-b5c9-f5798852212b", "sighting--d37a7eea-828e-4e46-a214-25a7726fc3de", "sighting--674863ae-7c15-4d99-aeba-c65cb03d77e1", "sighting--dfd0deaf-d2f4-4972-bf01-602e915f8762", "sighting--bfb159fe-52bd-49f0-9415-f2c74c48cfb4", "sighting--91f2c224-6d36-41ab-a889-1d8dc42f3dd7", "sighting--6bb24525-b539-4673-83c2-5d6aa2aa46bb", "sighting--3c482f7f-f34d-4b9d-a87d-81f1c83b8514", "sighting--a2d3b5d3-86e6-4f0f-b7a6-a8aa07644a78", "sighting--682eedee-b41e-4c74-93c4-465381d15527", "sighting--1fb78c20-1510-41c3-a820-513332a2ddcf", "sighting--94b98557-da2a-47fd-80c3-65fa2d691bba", "sighting--fdfa08a1-cea2-44f3-b866-edab59f00ef4", "sighting--6ea99833-e6a2-49af-aa75-87e38fac0cc1", "sighting--e3fdf2f9-c05c-49c0-8dbe-51004c6a8c6f", "sighting--1a6c7344-4077-47ed-9366-e77182732b0f", "sighting--de4e93d6-6614-478b-9227-cfb208773d9a", "sighting--c0efb96c-e231-4620-88ef-2cb4fa9f3341", "sighting--e0dac6b5-17d1-4369-baff-6306555928fa", "sighting--af25f033-90e6-45ad-8ae4-5fb864106aa0", "sighting--5c39a29d-cd16-4754-ac7d-c7635752220e", "sighting--bbf30ca0-ffbb-43ac-88a6-3ca845609abc", "sighting--76594acb-eb81-4717-b10f-7c93351f4d4e", "sighting--3b564698-2720-4d5a-96e0-393c06d1e488", "sighting--68cfa389-fdea-49c3-b243-3cfacb195cf4", "sighting--a90ab4fa-bada-49cb-a466-c3e65e31f008", "sighting--c10e49fe-0d01-4fbc-9679-f0156ad741c6", "sighting--665be6a9-3c74-4739-a701-72da5f6a3d30", "sighting--35b3569d-074c-4a68-a130-4e14deb469cb", "sighting--e0d363b2-310d-456b-965a-02458c33310f", "sighting--6c824c38-76b4-4e15-b9c3-760e7417993a", "sighting--a383d843-7d58-43ce-be58-888bae451d0f", "sighting--ad74f9c8-9560-42b4-b132-ec030645cbdb", "sighting--e4a45b78-0d6d-4b3d-ac1e-6a995feb8a87", "sighting--1b58c2a6-30d1-4734-80b1-865a9beb13a4", "sighting--8e6b3070-611d-4e2a-a37d-5cc0714e8d13", "sighting--809a2c47-fd31-4dfc-99de-46e1a2f58787", "sighting--573c9cf4-d401-4ba8-b01a-83dc08e4220c", "sighting--cefee655-1a5b-4ac7-b6b4-c5d37d8f608d", "sighting--49de53f1-c171-479c-84a9-331a1b94adc4", "sighting--dbffb699-66bf-4f1d-a790-70c324d20f33", "sighting--fc2aa019-2528-4308-9d44-635d6c11671e", "sighting--1dd7fe30-b417-419d-b754-4203e61573e3", "sighting--cc0640fa-8f76-4f6c-a226-283bc696efbe", "sighting--4f1d42a9-e828-4617-8bf6-f8f0ac88edbf", "sighting--cf580385-c777-435d-ae7d-9335caab5d7b", "sighting--b4f09434-0f8d-452a-81bd-d038f91534fb", "sighting--543ac312-5ce6-4912-bcf8-42456921c1b1", "sighting--78c4f333-6c9b-476c-a052-2b3cc4da9e3d", "sighting--ca54ae2f-6917-4402-877a-5b0bd7e5ca41", "sighting--59e3eace-3f26-44da-8ea2-b3560a5bf1d5", "sighting--9c001e18-18e7-4517-9057-f995d23371f1", "sighting--bb800658-37a9-46ce-a369-e4dfb0fff157", "sighting--a0b8b62c-f4a0-40a3-a3c6-36e11a1d4050", "sighting--6fc29779-01cd-48cf-ad1d-621836c9e193", "sighting--e04ed582-cafb-4f0c-87dd-52a95b1f76a4", "sighting--bd790242-a0f7-4f9d-be8c-f99dd00acfa2", "sighting--529437d3-8cf5-48bc-a8c5-3ea190e8fc50", "sighting--222b3e34-1795-4b33-a6a5-e9804fea04d0", "sighting--9ab7c4e3-61af-4cdb-9897-4e01e1de538b", "sighting--32fabc56-e781-47b9-8971-857cffaee324", "sighting--58dca366-8c0b-4659-8926-76b08c244e52", "sighting--1dc819fb-78ee-41e7-89ca-607db015929b", "sighting--ac0020d3-f6c1-4855-8f05-a2c6fe8bf500", "sighting--0e62bb97-6370-4169-8bca-fb850adb0073", "sighting--0a13601c-43e8-4281-b086-7c8db8b7644f", "sighting--b888fdb4-1487-4b4c-8cfe-448e3995dff5", "sighting--858b38b3-2046-401c-bd12-d56a2f7397db", "sighting--0cfb93cc-db99-402f-ad3b-67a7c3605f96", "sighting--3bd79f49-2431-42fd-aabf-67b94e0d8926", "sighting--b1cf815e-c6c1-4b28-9763-6c1452a41484", "sighting--4f212032-1f13-40c4-9d90-fba60c5416a9", "sighting--516be4a4-b786-46e8-9e7c-b4e6298d6f2d", "sighting--fcd196d5-3a5a-46d8-a5c1-ba6d3979f698", "sighting--1edb423f-af2a-48cc-ad38-ce74083f8c1b", "sighting--ba9bbb3f-900c-4d31-ad89-b321228c540a", "sighting--862e356a-55af-43a9-85ee-a11f82f28bf8", "sighting--c6529ead-b3b4-487e-9046-10bd118548b2", "sighting--83c1bc10-73bd-4e57-bf34-496e774e92ba", "sighting--91baea10-8fc1-48b0-b75a-343f20f664b4", "sighting--fdf00bb0-7e2b-4a07-bf16-3e110c6cb418", "sighting--732c3171-0ccf-4714-83b3-f93d331671e6", "sighting--b1008c0a-be3c-4c4c-954c-a07928a75735", "sighting--64816a5c-a434-4344-b1bd-f907c35b676c", "sighting--76058850-794c-4608-baaa-7404c3894f5b", "sighting--d2c06e8d-2766-4ff3-b412-0ef925ca2e34", "sighting--aa86448b-5e9c-4b3e-a6da-34a401ba2a5e", "sighting--4fffa672-2be6-4a0d-af51-c9cfb643efa6", "sighting--0af3e7ac-6853-4428-b0b9-fbad4ec27d3a", "sighting--789ce4a5-1bb4-40c1-9923-5507d9d9f80d", "sighting--287e5008-0997-4269-bd48-168084f8b92d", "sighting--9a771be0-3142-4ecc-8c3e-1279e38866e6", "sighting--9b59ca9b-8553-4ea2-89e6-9b5ad6bb476b", "sighting--6f279647-b3c6-42cb-9f13-987740158927", "sighting--cb267576-6dbf-40db-ac29-cc2944da91f0", "sighting--d4ad4fe6-db87-42da-b547-8ba9fdd88c6c", "sighting--1de3daf6-a11d-442d-ab9e-a4c0180af2e7", "sighting--73385399-42c5-4227-bff7-47fc97b4ee6e", "sighting--9ca2e0ba-1b5d-4833-8494-020b439fcd88", "sighting--a9d95b52-1906-40ca-8347-24a29349cb8a", "sighting--417cb8b6-f376-4912-ae7e-1d643129775c", "sighting--88d0d4e8-3100-4b11-ad73-7221f18aa183", "sighting--9cd46613-b637-4ab4-a51a-f8d3c706c013", "sighting--f8d54006-5838-497c-9fce-56e8b57c30bc", "sighting--3d387b72-0c7a-4f3e-950d-435884ee2174", "sighting--3003ddcf-b1d0-446a-89ef-49707f7c1711", "sighting--7206b81b-808b-44ae-84d9-ef22078dc208", "sighting--c2e134da-09ed-4a06-a27f-4fdb0c43020b", "sighting--73c384f1-312f-4b9e-8927-31e5b88fdeed", "sighting--2494d677-4fd1-4329-b57b-81129ebd90b7", "sighting--16c98901-2ab1-4eae-b0c6-bc59c6c74dd9", "sighting--b06dd103-17c0-4ab3-93ea-579da90be4ef", "sighting--6f6b3d36-45db-447a-b864-e74ec224a829", "sighting--4ea19ce0-d245-49c1-b9a1-966119bcd1bb", "sighting--aaf0063e-708d-4600-ac10-27203e1add9e", "sighting--0ba8b098-b9e2-4ffc-94e8-23eb07663c1c", "sighting--8bd5617c-ec26-40c0-8139-7a3a8cfcdb3d", "sighting--2033d31b-9b33-432a-b144-20a0d79bd830", "sighting--6925f566-195a-4821-abcc-fceea526a2c2", "sighting--30315c70-5422-4285-ba17-176abc573c79", "sighting--2da5d502-8cc1-40de-ae40-3fbe4cc43978", "sighting--1817b3ee-ea5f-49a4-98ac-c2de5eb93210", "sighting--17e00af3-ef68-4c84-aea9-e94dda9e9df9", "sighting--937c932b-eee4-4959-896b-71972931a691", "sighting--cd5dccdd-2a30-4cfa-925b-92143779ba43", "sighting--dadaa256-d8c4-4f64-9ab3-62671eeda924", "sighting--64ab83bd-7866-47c6-8dab-2f0828a8e53d", "sighting--4498d4ab-1057-4e60-a837-b90ea26c9d5d", "sighting--2ab7cf05-1c6d-4d23-93c1-4d9d60d0dd1a", "sighting--6d0be09e-cd74-45a8-921b-40d7e987c463", "sighting--478accd9-6e68-43a3-a821-84e2d3b910e7", "sighting--bbad8501-8de8-4af5-844f-97c9f224f3a7", "sighting--8d862174-1162-429c-8a22-ae0163bab84f", "sighting--adb9615c-d35f-49b7-86e6-8c82c044ed5b", "sighting--12f5ff9a-41ec-4de9-ba26-99847ab36397", "sighting--a70debb0-6bc7-4d27-8c54-0caf7b0fa206", "sighting--1e637eb0-b9a7-474c-8ebe-26fb8d07e27f", "sighting--cc35089a-a077-4721-9cd8-638094b61020", "sighting--593e0d46-82cb-4bbd-981e-8417e619e442", "sighting--05fb8987-5748-4044-acbc-e7dfe433494b", "sighting--d79ae7c1-1a2f-4691-8444-0b20eab1bbde", "sighting--2b00fee1-b1ba-4a15-99b8-108fd5670ddc", "sighting--727ed17b-4caa-4cc1-bb95-887842537d79", "sighting--e7ae64ef-efe8-4cfe-9ee3-aaaea8dfc06a", "sighting--c8f0d633-896a-407d-8d7f-0c57c7ffa86c", "sighting--ea2061de-df4d-4ae0-b8ce-51e289f58c6d", "sighting--c14ae457-e2ca-4013-86d8-8f1dfee3defe", "sighting--d312f84b-c504-48f1-ad3e-7939dbd667ba", "sighting--b9e97ec7-b3e6-4362-8e0f-dcc60f96b608", "sighting--f1257734-4a82-4fa6-96b0-ca806b2c685f", "sighting--1dfe76a7-f814-47b8-8822-7c3fc357094d", "sighting--3e4c56e5-b362-4e23-be7a-e9a7368d9e81", "sighting--2aea5d39-91c8-48fb-834b-68450c36b2ad", "sighting--06d4dfbb-6de5-40d7-b7a2-b1c93970bcef", "sighting--c928e8cb-67cd-4ecc-af2b-2c41b4ea5b07", "sighting--c9651c72-2435-47a4-bb45-f9ebc06a0671", "sighting--4078d4d8-1de8-40b6-901b-d694ee90a6cc", "sighting--14d0b3a1-c53c-4cc3-a1d7-e4d8837fb109", "sighting--ea3b7fbc-f8f1-4bd6-9d5f-f84924c612f0", "sighting--d1b767df-c528-400a-9e84-01c9d9549da4", "sighting--e840dd4d-f439-4b00-ae12-0412ec9f6750", "sighting--98cb1038-ff1d-44f6-a2fd-f85358935d2e", "sighting--ea1a89c3-22f8-4682-a72f-335c5580204a", "sighting--864837ae-33a9-4118-8e08-5577b98f7089", "sighting--67d7c723-6e9b-4322-bee3-468cc38d2f46", "sighting--6c2d9c9c-a876-4066-96dd-d55d2b73c9ad", "sighting--8039651c-1a1f-4251-8021-a9cf4276f2bf", "sighting--3640ef08-8567-4cda-84b9-531150b46b6b", "sighting--4e72d96f-2bd0-418e-a5f0-460d9a504ef1", "sighting--4af57492-37fd-4aa5-9a3c-0edd4ef156e9", "sighting--19215401-3e31-46ab-a0e8-8e0453f4b4be", "sighting--1451ac3f-26c8-499f-80e6-5e4c1fa3929f", "sighting--b8645c90-a9e9-4f4d-81c5-c4fa85e92291", "sighting--ea9be0d3-604d-41e0-9f93-f06272998e0f", "sighting--962299ad-a48c-4ac3-bdb0-04babb96761e", "sighting--cb260022-a2f5-468d-996a-da96a1b5be34", "sighting--ca256afd-59cb-4473-ab57-aa177128f9bb", "sighting--65112db1-7e84-4c0d-9c0e-a9ec6d791646", "sighting--3ab3b497-ee16-4a70-a60b-fe8429c0e272", "sighting--e5aaec3d-c6c4-429e-8c88-4353d0616f6e", "sighting--c55ad570-e746-46b2-a920-c050eb651407", "sighting--ef174ac1-a11e-442d-9cb7-8871fa392d69", "sighting--176158f7-9cb1-4a49-8731-0a2fc06901be", "sighting--ec449432-07d0-408e-a050-a1dc5f40b659", "sighting--422e223b-2671-4190-9ddc-05e1b8bb42d6", "sighting--2756918b-fc9b-4ab2-824f-c3f461d95007", "sighting--733bac92-58b2-46fc-bfaf-19e76bed0c93", "sighting--d651589a-71d1-4152-8fc3-8743935f152a", "sighting--8465e7a7-11eb-42bf-9f4c-0380db99a1b5", "sighting--92957248-8522-4265-b9dd-e2cc60f28a89", "sighting--293f073c-015c-4cfc-92fd-0c27a04e1d7c", "sighting--44344255-b22f-4c39-8e1d-e8dbcb3a67ff", "sighting--c8a12eb9-4c17-4a09-a3d6-5d38abb32ed3", "sighting--8668f91d-9d88-44f1-90b1-be09a0b159a8", "sighting--e5c22c46-c4f2-4893-a059-a07ab22ffb8a", "sighting--c7168f4c-c067-417e-898f-6c483b0f1005", "sighting--4ecd8b92-825c-4be7-97c5-45112e9fb95c", "sighting--7a479a4a-20f0-4d1d-a2c4-9e55d1a07478", "sighting--74973e46-396e-4fe5-9d97-c884a541fa56", "sighting--435ae207-7d5a-45da-8a17-8cf841ef5622", "sighting--a31210de-a8fa-4e64-a64d-b22a71f9d2c1", "sighting--94a88faa-ab98-4e9a-b415-f6aecce14755", "sighting--1f1dda7a-b118-4e2c-98d5-d4452e7deb67", "sighting--f7e11a14-db26-4e39-bfb9-ef22aa6c8cb3", "sighting--8aaf52ef-d470-493f-b06e-66d152fd2a42", "sighting--7df2665a-076d-443c-8755-955dab027818", "sighting--60268dca-9037-47e6-be3f-0f3c6d65a187", "sighting--7fc89a30-a081-450b-9f11-d7931208aa36", "sighting--29a27f1e-75ab-4d99-b6e2-0bf1c39215e7", "sighting--8a7e7fa0-763a-4b4b-aceb-176549d1b1ab", "sighting--90e6dcae-d004-44a8-a255-0870cce56f61", "sighting--580054c7-a522-42c1-90b5-7301b09da0d4", "sighting--c0ca3c5d-ea49-4340-9db6-054aa090e890", "sighting--0afe5e36-a56a-40fc-9425-dbee97e63754", "sighting--ed9caff1-407c-4742-b8be-44f1854907c6", "sighting--ad9f2136-40fd-4dc2-8a3e-032fd700eb30", "sighting--30a4a008-c7e5-4f19-8416-9b7582a8bddb", "sighting--29ffbdac-bd26-4562-91c1-7b5f4609192f", "sighting--d56d3cf7-d77f-4c2b-957d-e96e20648fe4", "sighting--b1e8d6d9-1aa0-4c07-a454-47bcb83fb352", "sighting--4882eb93-64c5-4e32-be52-3fb1d3761d2f", "sighting--88c47355-6f74-4358-9992-190ab9181200", "sighting--3ad7f098-deb5-41e4-a835-7dd049c5ea20", "sighting--ed2afdc1-b35b-4103-81a2-d5fa042c6a37", "sighting--8f5e7838-7816-46a8-a4fa-7eb2a3a79ee1", "sighting--d5eb2485-3170-46cb-b017-cd25e2a1294c", "sighting--3128ecbb-b4b7-4ffb-b873-e7fd45dd6127", "sighting--9d680bb2-4d6c-4a0e-b0ed-4691de91bfc2", "sighting--ff3a8d12-8af9-4efe-bab8-f3a5a583e98d", "sighting--7b87cc9c-d36e-454c-9f17-87bc98705d71", "sighting--aad5f0ae-a6eb-43b9-bb65-fdffd60a1912", "sighting--a033ba17-42f7-4609-b656-cb8067c4d81f", "sighting--2236efbf-0efe-45a6-b4f8-7df94e64f94b", "sighting--4473ef61-db1f-4782-b760-60a3598b9856", "sighting--c2320259-5df5-4ad2-bf63-7eccb86a7a0c", "sighting--739e0ce6-71b1-49f8-bdae-aa4d2518f45e", "sighting--79b2f2a3-fe55-4110-a189-a0860102085f", "sighting--3399a21a-4990-4c27-9909-bc9d277c8591", "sighting--6902a561-b685-42cc-8fc6-e161b11f38f8", "sighting--c0d8f6ac-865f-436c-809b-131733039ce0", "sighting--5d8e37e2-6619-4414-a0d0-90f78c98b7e8", "sighting--a7eead9a-5990-4e4b-a8f9-9b1090a62b22", "sighting--7177495b-ec32-475e-b794-f2433e0aaee9", "sighting--2a39832a-71d0-41fa-b98a-633bd86f5144", "sighting--52efdd53-c639-4d0d-b5fa-ce70097806e8", "sighting--4ebb155b-1674-41c3-93ee-396f8ef8ad8b", "sighting--c742cc36-a2fd-43cf-8c38-5292c6b5c37d", "sighting--aee641c2-5095-4dfa-a757-ea82038eedfd", "sighting--f22236bc-da55-45a0-a487-b576ab9aeb39", "sighting--8329fa50-e373-4e20-a7a4-ad632bb3851e", "sighting--4d46e1b6-7c22-4a05-9d45-650704b19251", "sighting--45dfc6bf-4cb2-4355-92ec-3d356e66cc95", "sighting--087140c3-18b4-4e01-9866-efcdb8d6a1a0", "sighting--62c07455-e092-4c39-8d96-b052312636f6", "sighting--1411ce2d-4746-4582-980f-08e1ffdab770", "sighting--7eddd500-1624-4ae2-8e42-51cd69a854f2", "sighting--bfcf1fb1-c4c9-4c4c-894f-bd2914223fa3", "sighting--83bfc904-704b-4ade-87b2-3186a9d3d58d", "sighting--e38d1bc2-0600-4788-ae34-a128033b2502", "sighting--419654ca-ef06-4ef0-9eb1-e30cb3dfae93", "sighting--277ab201-9b50-4dcf-bbe2-055c87d46637", "sighting--5cb829ca-5ba0-42e1-beb1-096b7dd5dc86", "sighting--cf907104-0658-4946-81ad-d624cdfcf5d0", "sighting--60f254ff-a757-4214-8087-bee31f1a87a0", "sighting--23ce418a-a0ff-4b71-ab07-4e84da4fbdc3", "sighting--cc1bd6bf-8d97-474b-81b7-1e46ae36ec77", "sighting--4722d40a-3610-4561-b06d-c265602d83ea", "sighting--9508a8af-0099-4d61-ba55-92d7e3d5f407", "sighting--9363fe12-1403-492e-bd38-b45b669b2ac4", "sighting--a53c9479-7b96-4980-901c-4afd6376b88e", "sighting--c15ad0e7-0b53-40cc-8e39-0d9c0489d7b5", "sighting--d19b767e-9e0d-431e-8790-33eb3fa592c8", "sighting--be6d9d89-81ca-4c71-ae3b-e11b8882c045", "sighting--8ed7efb6-b6fd-453a-bcb3-faf650bc326b", "sighting--00d599f9-4ab4-4fa6-b96a-e22c8d93c598", "sighting--d5d9e455-b0dc-4485-a0ee-f2ed5271b5f4", "sighting--3f75ae1c-5f58-41cc-9c1c-c5e411dfdb2a", "sighting--acc6f7dc-50f6-44a9-9986-cffd31f823f1", "sighting--e7163499-03a8-4739-89f3-8933c5d3dae9", "sighting--47b34fda-bec5-40ae-9fc6-e40f50d8de20", "sighting--50c3d5f4-1154-4ea7-92d0-95a44f00b48e", "sighting--11801f2e-aa95-4f3b-a462-3cf933f75588", "sighting--b1a08552-a6ac-41a9-a7d9-f8b019f7cfd1", "sighting--15e5d4ed-e0ef-48b9-8da3-3596020cd73e", "sighting--8c45c390-81e6-4a5e-a39b-f021f08bc4de", "sighting--922d3737-5a58-45a6-91d5-8d209ddb95eb", "sighting--586e13ef-ccd5-411b-af16-1b5617688b9f", "sighting--eafa47b8-6c7c-4a90-ab96-c1eb06ba5b56", "sighting--c983dac4-1e3d-4ced-9f3d-1b791b6cb424", "sighting--8227529e-9187-4504-ba5e-9f2385534424", "sighting--ef7db883-eeda-4378-b88a-9e0f506d3863", "sighting--35b3dbee-b44e-4b26-8dd9-ee718de067ab", "sighting--90cdd12f-e1d4-45a9-b04b-b34de6ebf4c2", "sighting--01577958-0529-4b84-a518-0f509dde0e63", "sighting--0b46c31d-eef6-4bba-88c6-f082a9c738ef", "sighting--1ec34b51-af31-4744-826c-f9754796a6be", "sighting--02316fc1-c1ad-460a-9f25-a3348fc7ca3a", "sighting--b2a3abcc-a2a8-43d7-a9df-389fc77d2af5", "sighting--b3bba36e-d18a-4366-871e-79023d31af24", "sighting--e8aea27f-8504-4438-a525-f366f6b2a35f", "sighting--e91af229-1b48-4c50-a5d7-a2bdbcf6e749", "sighting--69c6b865-152a-4190-bf5d-7d35722deaf1", "sighting--afa0c371-d9cc-4004-8c0d-e28bd813a7ea", "sighting--17a66af0-92d6-46e9-956f-66a66275e401", "sighting--3977ebb5-c80e-445b-92ee-28cc5de7b8d1", "sighting--ae56d662-4737-4fac-932f-0fba7264174f", "sighting--b8f4e629-bd03-4d2e-abe8-30132ae15bb4", "sighting--bc634c28-23b4-410a-947f-25b4ec2b9e9c", "sighting--3c0e222f-1199-47c5-83b5-80e978b6edb4", "sighting--b29574aa-b5f0-4e9d-97e0-a3fd53105ee7", "sighting--7053d0ac-7361-4527-96bc-b2f1d4e127f2", "sighting--67a4d118-c0bc-4ac5-8dc5-456fcb6c3881", "sighting--5bf8accb-2435-4056-aa05-dd7dd4067bad", "sighting--1cb1eef5-cdda-4753-b468-41e6dced24c7", "sighting--f1cfc01e-d58f-4c50-bfa7-c29bd2d623cd", "sighting--df9c08b8-6266-49f0-9ce2-9c265e94043f", "sighting--3c724da4-be14-4e49-99da-6aa2fb768a8f", "sighting--a9a2bcdc-5496-4d71-a1d5-b521cfaf5ebc", "sighting--13574dbd-3068-47bc-aa38-f894701099a7", "sighting--040b98e2-0277-4d81-bf7e-1cf46a3a74bc", "sighting--67ce8632-17d4-4380-aea4-c10723f4c2e3", "sighting--4a152f69-631b-431b-a9c5-5dbfd79f561e", "sighting--3b88796e-25c2-4780-8106-6934ce09c82b", "sighting--ea6d3cde-9335-4eb3-b590-c9d504e34878", "sighting--35f986ce-9302-4c9e-8cd2-78a08a30a60d", "sighting--ad784ac4-496d-4ff0-836c-5305608ad23d", "sighting--8089a6f0-7541-4d14-8466-934f3a1d1b63", "sighting--d16b29ac-4658-4ba6-b5b5-03d62a1cc06e", "sighting--5e5e475b-95dc-44b0-be4d-e1b3dacf5c83", "sighting--7a405ad8-eaa5-4316-a211-430867307160", "sighting--f9518733-6274-4aa5-aeaf-9cc87efecd51", "sighting--81631474-a054-4e40-8b60-0c4e840abff8", "sighting--5934f1d1-6333-4c63-8251-8d03232f4323", "sighting--ae0fbabe-1779-42aa-8e40-037bb44fd61d", "sighting--fd1933cf-9bdd-4504-9162-3148278fb094", "sighting--5d60495c-239d-4a49-bc13-891e3826cd8e", "sighting--7906239d-02b4-45fc-b776-424898f2a8fc", "sighting--4f91a141-7737-47d3-bc93-073ec9f75d43", "sighting--2cf17152-ee07-4d3c-8993-60905d2e83a7", "sighting--fb1b4309-5b99-4451-9526-7bbce98b2a8d", "sighting--8bf97c5e-758c-4b81-b981-59fd4c01906e", "sighting--f645d87c-dabc-4a22-8a07-f2ce319d1c62", "sighting--71ad5c84-0f34-42ce-b34f-cc1a6b2454b2", "sighting--3bdd1478-8eb4-4897-af11-6b724a0ec0dc", "sighting--1619dc0b-fc9c-4565-a3d4-392f005eeba4", "sighting--65bb9cfd-215f-4eb8-83b0-e4ec5fc6c8ee", "sighting--d4814ef7-cc4b-4237-a8e8-9c85a74b5908", "sighting--aab146cc-dd5e-4c7b-836e-a781a55a52fa", "sighting--43d55d23-5384-442d-b3d8-481ef757efa6", "sighting--ca54fdcc-5b99-471e-b416-1f53fbabfa90", "sighting--62598c32-a440-4b9f-a064-978d314ef0cb", "sighting--e5d478f1-b8c0-44ec-a538-e4d03e681c4e", "sighting--0a6e1731-7598-4d30-8888-477f6d86a47b", "sighting--84e3955f-a5f3-4129-a399-8d282cdda63a", "sighting--8337b167-2215-4a14-ac4d-3dc4415f0102", "sighting--72565cbd-2d39-4605-8201-534cb95c5d8d", "sighting--646e9234-e9d9-4fd2-9127-51e8eb7d1b84", "sighting--506eac16-a964-4f99-9bb4-82a2737de7a9", "sighting--8cac9075-42d9-400b-9748-016ac2c277da", "sighting--32631e45-4598-48f9-a6b6-aacb3eb1485c", "sighting--c98c02ce-f6bd-4314-9d7f-93d7e26895a5", "sighting--3ef76fec-7fb8-47f3-b76a-7981ee67f3fa", "sighting--6fec23f0-9a86-43fd-9b08-e2bc12d57692", "sighting--872f6f5f-3d23-432e-a26b-d027dd5a6436", "sighting--c8bc1b4b-8c61-4783-9aab-101bc2e2877e", "sighting--56e1288d-8b3c-4be3-85bc-2d0df07e817c", "sighting--ed0c7ccb-e81b-4051-af29-85dd677cc302", "sighting--d796c18f-2447-419d-b336-a6452f49f25f", "sighting--ba6d1c80-d33e-42d2-b153-318d533d84f2", "sighting--9e4c33c6-60ee-41d8-8782-d7d7b6ac50dd", "sighting--96690e77-3b36-4030-9da8-bfe8d8558036", "sighting--1ee61a44-a86e-44f4-a76c-db2de14ed8bc", "sighting--9bc5cfb6-9815-46d7-83f6-d352a054f17b", "sighting--231d5c40-e7da-4e2b-a651-c2479880c923", "sighting--ba4e3500-b5a5-4ec9-a5f5-4119df3e3952", "sighting--2fa65cee-e9e9-4f86-99a4-229a71ed9d04", "sighting--bf7089af-623f-4ab3-984a-c53fb2c0e777", "sighting--c68f59f5-067b-4a07-bc3b-bbd9c562a36b", "sighting--e517f539-88cf-4838-8e43-8d0797e878b3", "sighting--92c26dc2-a4b6-46c8-9141-f98af09fa7a0", "sighting--7357e3d2-8ee9-48b7-af42-4e3ba87b6f9c", "sighting--675a6059-8cd4-45ca-a5a5-111a9464c0cb", "sighting--7b8c25ee-3c24-48d2-9368-d933c5cc70ef", "sighting--b64d6f3d-5056-4b99-8510-2bcd8d31f073", "sighting--64d993e0-d7dc-4247-b1f5-a02490461679", "sighting--3bd0d6ef-0f85-4396-9e81-74699fc51f61", "sighting--cba751c7-3dc4-4530-9b8d-a2c14ff2c9d1", "sighting--534be0ed-6c7e-4259-a0f0-9bb03adfab5a", "sighting--2d48a251-86de-4d40-a1e3-de4f1fbce5b0", "sighting--97ace3a9-9e4e-4cdb-b65e-12609a5ed070", "sighting--347772ac-745c-4f45-bcdc-b004d9e001c7", "sighting--0a52b902-5fc3-4a7d-8909-ca423a136b4c", "sighting--c420651c-59ad-479a-a59c-506e34aaff67", "sighting--d6bf1ccd-7d2c-4f5b-97be-660a195e3e18", "sighting--b6c4548f-0872-45fa-928f-8adccec24b7b", "sighting--8b9666a7-11ab-4452-93b0-ca93768d46a0", "sighting--6c8a3271-7b14-417b-bec5-159bfcd07773", "sighting--3a46a697-79c6-4f2f-a56b-aab1a95b3a2a", "sighting--4c1dbdd1-0128-4c98-a2e8-1f1b1eaaa5e2", "sighting--310489a1-a000-4c1a-a593-949ceb7b0644", "sighting--9fdf7e3c-9d1a-4202-b602-2376385dc8d6", "sighting--abc0567c-c7aa-46ec-ba88-a9c7e3dcb4f8", "sighting--f08befe1-6606-4bb8-86ed-9cd0180e5144", "sighting--1e0415d6-69e6-48c7-bfac-6bafe5b9e1fe", "sighting--c87fc4d9-f448-4b1e-b3fa-6e524c2cb729", "sighting--66c0bbee-78a7-4a6e-898c-174acf7fe049", "sighting--5651c322-0c57-4f7b-a5c1-e3e49d6159ef", "sighting--049c2fe4-8e82-4c10-bc81-12188d5875b5", "sighting--b7fa1990-c792-4a56-8936-986ce613eba3", "sighting--c600cc89-29e4-4338-82d1-06b141bc376c", "sighting--3ecc5d8a-d71f-4c8e-86ea-412c889e4647", "sighting--75f7a94a-42dc-4ab8-aa01-7f728cf81d72", "sighting--379eba7c-2553-4681-ad80-be8175a2d439", "sighting--a356e3cb-159a-4bb1-b627-e3b121e4b025", "sighting--b679cf96-ab63-4be9-b6c5-7ff82291a8d0", "sighting--874da16b-a1ec-4bd0-95b5-51618750ba60", "sighting--3f909a49-9b48-473e-9bcc-908d261a011a", "sighting--d540ee4d-3a93-4034-9ed5-18d8d702de1c", "sighting--f20ce928-64c1-4122-803d-b209ba39d6ae", "sighting--bb84d4c9-a809-4277-bcee-893c34a1f854", "sighting--7ae0d23c-9afa-42da-af53-5c9afcdc0000", "sighting--29ddc4f0-55c4-437b-9bcc-482b191bea6f", "sighting--0b052472-52ca-4970-a418-6e9a38688a38", "sighting--737e4e1e-67b3-4144-8697-fe6df257c366", "sighting--c876fe45-22c3-452e-bec2-267d9d2bcefd", "sighting--2a467b40-cb90-408a-bce8-49c0ecb1f117", "sighting--80fdf836-c66d-4066-bd68-e318bd7f0d8e", "sighting--cf44e022-639c-4a51-b2b1-965763f3ff6b", "sighting--5ada847a-38dd-4482-a2d5-c9ecbe2d7318", "sighting--bba02b1c-cc65-4c33-b9fb-226acf9863d3", "sighting--f0f02099-6cf4-49a7-b67c-4106c748b4ec", "sighting--c7ee5071-5cdf-4ffd-a6b4-d4380686eb8b", "sighting--67fd33fd-3b5e-400e-83a5-9213912437e8", "sighting--1ed23709-96cf-4c42-aba8-0ac780dd45c7", "sighting--c291bfbb-f691-4109-bfd8-0e94ca868eab", "sighting--d273eec1-8584-4955-9a2a-170406863717", "sighting--56ceed71-e74c-4aa4-8c8d-2799282e2403", "sighting--f98ebd43-633b-4dc0-ad23-8c7abdabd93b", "sighting--1f26c857-bcd9-4c41-8e36-57d94238ce9f", "sighting--ddc29911-34f7-498c-bf2b-7c7f6f75c1ad", "sighting--310dfc1e-56d4-4d9a-b62b-e5e8f6b3f97a", "sighting--fe6751eb-e4b0-4fb2-b9c1-7bd809a9d810", "sighting--573dc960-59e9-4795-b143-38df1fee6795", "sighting--569ba631-d9c1-4a77-9bff-b0f642253ea9", "sighting--a05740d1-4ad1-44ae-b568-42ef66412c04", "sighting--b1236037-4f9a-4c21-8ad4-489d2501e900", "sighting--00bc6e17-c67d-4154-b39e-247592424bb5", "sighting--2d0ab553-ee9c-4131-a5e8-5577d6bf9a42", "sighting--765f8638-aef6-4970-acb6-028e12585508", "sighting--c5738b8b-5b8e-415c-a0cd-1b71129da60b", "sighting--267b289f-65b7-439e-8fdb-b092062ece46", "sighting--5f5d9541-387c-4db9-88bf-6af92df83af5", "sighting--ba9ff5d8-e40a-4195-b9a9-17a3d7ecd046", "sighting--f509a66c-d7ba-4243-a6d9-5b86f84f8e3f", "sighting--8794d12e-8f5c-4708-ac30-5a1adc256582", "sighting--7876a3e7-a7e1-469f-9735-7544c3419750", "sighting--4a2e7747-60f3-4e5b-b897-074c5572c1a0", "sighting--f974e4d7-5f3d-4dbc-801d-8d002cfdbedb", "sighting--f70021a3-0d4f-41cb-a628-3df631d073b8", "sighting--4b61b88e-348e-4f7d-83d0-3a55bc48cc14", "sighting--54250e0b-0bdb-4007-94b2-e8a181bda2ff", "sighting--1d457694-7fc2-44f0-825f-397c9c791f2a", "sighting--e6ed2f24-0385-46ae-9b0b-3268aae866e0", "sighting--76865835-e3e2-4882-bf29-6cdd5db47023", "sighting--fcb51d4b-b9f1-4499-bc3b-e5dfaec3e6b3", "sighting--0413fe28-16df-46ba-a6fd-799e5a9043cd", "sighting--dfdf5c37-ae9c-4595-ae3a-998689011513", "sighting--aafcca9e-c9ae-4aca-9c7f-5ca090cf6bfd", "sighting--4a68123e-cd55-44c6-b95b-90070ab02e77", "sighting--5e77221f-de58-48f3-b40e-d4c4597ba932", "sighting--345fe2d6-63d0-4ccd-a27d-68f7f2c5808d", "sighting--5db2cf5b-c5bd-4ae3-bebe-709e86196904", "sighting--5d47f0bd-9a60-4f72-9b97-609646d93c80", "sighting--573c0ca7-ed4c-466e-b90c-ad96505cb974", "sighting--9265e549-7c2e-4f54-ad0b-f1a2c9834b4c", "sighting--b59b495c-1250-45d7-ab48-7234cdd5b769", "sighting--21c405c8-429f-43c0-8876-42900df26041", "sighting--a81e1b3b-3e4e-4c0f-8fc6-1e4151f57e18", "sighting--45cfff13-1427-4031-ad15-4b1b58fd893a", "sighting--090c8823-8f9f-4125-9ccc-309cb0aba711", "sighting--60240d16-cc3f-44a7-ab83-686aa5be22b7", "sighting--2ccb1a28-ebbc-41e4-b2f0-1c3c2871c37c", "sighting--1c61474d-aa37-4cc5-b3ef-57e37cf38544", "sighting--f52068df-5f47-4f31-8817-6af77a4f4e5b", "sighting--cf4b44ff-69ee-4cdb-a7bd-5aa5d0652052", "sighting--5fd72f82-8855-4ddf-be06-af6b35287590", "sighting--1983dc25-bfb8-486e-8a6b-2044d0f92ac2", "sighting--605f6fc5-706e-4a00-b425-65c84c06f5ba", "sighting--035af8a8-46b5-4721-9885-e639a891d357", "sighting--4a8d6898-131b-4268-ae39-a2f8738e6dff", "sighting--cf528087-f3f7-4c6d-a063-79c69fd94e1c", "sighting--f5ef3e07-2b7b-4a7d-be33-dbbe2356715d", "sighting--bca2d639-be4e-41bc-b6f1-87f885d7621f", "sighting--96d70c49-b079-4926-b780-e7cdc2ec2ce3", "sighting--2726f455-6072-4187-9b66-9f0738081261", "sighting--87fa2db1-5ea5-418f-a7a3-22c5d48cd3cc", "sighting--74d4475a-4e36-40a1-b6c0-b00d4b028f24", "sighting--2b01babd-d829-419e-8ed9-8271823ab5b7", "sighting--a4832844-0c1e-45a7-aa77-43550eb37bc9", "sighting--61d38b7f-6b89-4e8b-a9a7-5f8829ebe431", "sighting--356040d1-77d8-4a8e-a275-c96b8d9db088", "sighting--9b5d27b5-5ba4-4cb4-9dae-549fab5c3e49", "sighting--90fb3441-6904-4e7e-b5d2-05c4ef4f69df", "sighting--4a4c5d65-a66d-4a9b-9d1c-09980950b3af", "sighting--7a64f016-e434-4fa4-af64-75eb4eb22b5c", "sighting--4c1fcc60-26b2-4b05-ad78-6d47d4f28694", "sighting--2800ea28-61b5-43c9-b5af-1bd9e4780f14", "sighting--95f09ca3-a42d-48f0-9110-de3939cfef8d", "sighting--59e5e987-d060-4943-9925-466789936eab", "sighting--20094907-cb32-4b00-b56a-78c9871c74f3", "sighting--26a01d82-8b74-4603-88c3-1caafc73cf74", "sighting--7862f17f-eece-4dc0-92ad-3fca364812a7", "sighting--10f09ce7-9d9d-4bd4-b792-451c2688f8ae", "sighting--1179f543-39ca-4f37-a2b6-40e3d3d4b689", "sighting--6f948470-bfb1-4481-9401-eb8a7aeda870", "sighting--65e7fb28-73e0-4ccb-937e-7f9a85df8a6a", "sighting--48f6a08c-323d-433a-ab42-5467dde9b0c1", "sighting--3a58e5d6-18e5-49d8-8bc2-662aa2d3503d", "sighting--97571b3a-5b28-4209-b982-45dd8be11786", "sighting--5d72d41f-4fbc-4210-a743-6f0ddd55f27a", "sighting--2427e26a-76a3-4052-b506-f6844aa2ed22", "sighting--f8e00aa1-66c6-4b85-949d-fe72596f84e7", "sighting--70a717db-4c5d-4d16-8caf-763a74f5c84b", "sighting--f7d1b59a-7aed-43f1-be5f-8808747ea8cb", "sighting--46b4f043-bcf2-4984-9010-54af4dbf4366", "sighting--4e81f084-3de3-4553-afc5-d51ca982556e", "sighting--df3804e2-2c82-4f3e-8064-35f9b2f7761f", "sighting--475140bd-2250-4231-8662-495467bdb20a", "sighting--65e1037c-aae9-42c5-bb7c-fc8e38ff928c", "sighting--370ee09a-3b12-4e01-888b-99bdb5de708e", "sighting--76ec8520-1214-4aea-973b-1e27355a212d", "sighting--9c56a224-72dd-4a7c-b16d-c0a898407908", "sighting--61020abe-9e3b-4c66-b284-978a292fc001", "sighting--dd3a8a07-6fe6-46d0-bc87-bf36f4faa4b8", "sighting--ab59c18a-e3c0-454f-96e6-1c2cacc7e735", "sighting--b1629f94-5633-4a2a-b5ef-5ddd182d8c6f", "sighting--13490f69-a53b-4842-b504-b8dc4d1c4f51", "sighting--14a0a54b-553e-4276-a15a-5d23f9e0f800", "sighting--9c730ed2-3fca-47af-892e-d4963ae0d973", "sighting--95538fbb-661a-47c4-bbf4-70e8cf306c82", "sighting--82d353b6-e1ed-48bb-b2d3-e808e40f05bf", "sighting--241e7e1a-a18b-4e9b-8a88-7f7b5d0b7cc7", "sighting--ee5c0eed-da93-4890-991e-b595e97911e0", "sighting--b4dc9f2c-bbf3-4774-8772-39c468595538", "sighting--188c45c8-be88-494d-a59e-7de02b37c267", "sighting--f9b31748-1b3e-4f97-8c1f-8bc80d5c2422", "sighting--a36ca024-0072-496b-bcf0-20e2c20f124e", "sighting--b6604340-e53c-453c-9152-bc38b8776e6b", "sighting--9eaf298f-ae26-4864-9314-832a54bb4153", "sighting--67cec15d-df95-4992-b8f2-ed397d550839", "sighting--19fd22c7-7633-496f-9fb9-24b3a38f5334", "sighting--0c3e41da-8f7f-4c17-b771-a56f8b315e99", "sighting--5d84a468-dc64-49ec-872d-a4cd89850797", "sighting--08fdf553-cfc5-474a-b25d-5c12e361ea9f", "sighting--c3a301af-5f03-4cf2-9640-de8214b74bb3", "sighting--cc32400a-11b8-4a1a-be94-8750df22c70c", "sighting--fcd0d5f2-6452-43b6-ac3c-e61bf6779837", "sighting--ab410258-b75b-4446-818d-b5d202b06825", "sighting--f813ef7c-ac31-4658-8854-e63ce1572e19", "sighting--62e38f93-640f-470c-ba3e-bff1bcab0163", "sighting--d0f1e372-5ce4-4647-9411-471ab85e7b99", "sighting--aa9fb24e-ec3e-427c-b789-20dfc81d39dc", "sighting--06ae465d-907d-4f26-9bd7-b1ce0f765bc1", "sighting--895936a7-dac2-4d1d-b0ae-658de6bcf89b", "sighting--92398421-496a-4d1f-8d1f-4376bf42184e", "sighting--e636addd-92a5-45c1-aa45-558f294665a4", "sighting--675aebdc-472f-40d4-b3cf-e9dac0ea1d1e", "sighting--c0234485-4bba-4693-88ad-df0b1dd4a4fd", "sighting--1a10766e-c090-4eb5-8016-3491671ff3a5", "sighting--37e60b64-a89c-49ee-85fb-98ffaf84112b", "sighting--6cfc3655-6121-4016-8bb3-f5095edbecc6", "sighting--e1d3cd0f-fd5e-49cb-ba6c-dbda522379dc", "sighting--e2fd66e6-2a9c-49a8-b666-14931f7cfb0b", "sighting--0daffc40-6b37-4af1-b3b2-f3fd5f4dae6a", "sighting--d8143061-b157-4d60-b265-c3b5564f81a0", "sighting--fc3fb22b-2a8a-48a2-ad6d-db086aff17a9", "sighting--cbf919c8-3a75-49b7-b3a5-ae20bdc27aad", "sighting--fd34735d-5c22-4233-9c56-5dc81b7f06de", "sighting--47a256ee-a057-4220-b781-433720c565c3", "sighting--15ec8f9e-e3dc-48f7-8af3-8f72eeb413ab", "sighting--b80324aa-618d-4afd-bf95-cc024c79cabd", "sighting--39d7c484-b2e6-4fa7-9b22-17e08eea6636", "sighting--29d14e70-9a51-459e-a964-b235ec3652c4", "sighting--0d1fd6d4-6a6e-456f-bca1-feb1818258b1", "sighting--25d61cc2-d715-4e58-bb24-3761b57b864a", "sighting--65b8b1b3-f74d-4ca7-a377-4b4fd1e66928", "sighting--4299d783-b0c4-4205-ad3f-54414827ecdb", "sighting--288e9e94-4b91-4a2c-82d5-e0dfa3772aa3", "sighting--5d4a07a8-bc09-4ed8-b90d-d8ec12f85a36", "sighting--55ce8f16-8331-451c-9344-7ed83fed4ff5", "sighting--0882d85f-c478-4957-87f6-dbb06442ce3b", "sighting--ab4689fd-4c0c-4a6a-b5f9-6fe4d7b7aec5", "sighting--7d712fb2-d179-498f-83a6-77280ac085c2", "sighting--c4307dd9-c298-4063-ba65-db152f815199", "sighting--ff25ed33-ccf8-425a-9ec6-a7431d1be5f4", "sighting--61609f02-a17a-4b1f-ba8c-3ce9ac94d85e", "sighting--509554df-01db-4303-aca3-664eda6de7e4", "sighting--a4c6c4a2-72c4-4754-95e3-f071d5769824", "sighting--f6c2b6bc-a0de-4516-96bd-eb2e99be98a7", "sighting--70a83b66-5742-4fe3-9900-4411e4df2184", "sighting--10091d4c-e2ed-41db-8e5f-78ee7f17e1b8", "sighting--b56dd0a1-ca99-4873-9b11-422db33c4a60", "sighting--76e74aaf-7ba6-4ee3-a208-b1ff884c64fd", "sighting--24e37dc3-8c40-4ce1-9793-dad87ac1798f", "sighting--a339375d-7dc2-48ad-ac16-c2765fc55c95", "sighting--179c4ead-b452-451d-a52c-4e155263030e", "sighting--8438a3ef-439c-4c73-84e9-003e68a188ce", "sighting--c7e07fe3-3135-45fe-8241-e791c1763d91", "sighting--c428c8f8-44be-42c4-8997-32c52c9d3a03", "sighting--867049dd-ef22-4ba0-aa42-753d174c2345", "sighting--41768654-678a-4d11-9680-ade8bfdf7f8e", "sighting--c8c7b47c-ff7e-4a52-8a0b-b0929fb8c5f9", "sighting--68bdc20b-32f1-419f-9dbf-b3fac925e254", "sighting--4017f375-fdd9-484f-9636-5d995b003c46", "sighting--f4449c1e-9cdf-41b4-912a-2d1a5900ecb4", "sighting--828056a4-acce-4f71-a5e1-cb7d9e2aaef3", "sighting--b2d8d457-5bb7-474e-b10b-cb0c4b91820a", "sighting--b2f50a13-ed6c-4c7c-9e13-b86d5791b5ac", "sighting--8589a362-3eb8-486f-8069-080b8bed8e27", "sighting--c2293073-d6cc-41d3-841a-97a42634a767", "sighting--3879046d-4316-4c15-958f-d521cfb3ba18", "sighting--ef3a7185-cedc-4132-987f-0584519f5e51", "sighting--56c48455-2f0a-49c8-82cc-c5ca0cf6e3b4", "sighting--358c9758-7923-4959-b47d-71b2f55fe075", "sighting--ce26d9a0-fc0e-4696-bb57-afb08fc35bbf", "sighting--4fdec20d-cd24-4f32-ae76-401b14e7940f", "sighting--44e895ae-0500-4cad-9744-2f0e0df69b03", "sighting--1d91da92-16dc-462a-8427-0eb554845622", "sighting--2b8b151a-e04b-49e5-a95c-7140d1d5e849", "sighting--b2f916ce-9086-41b0-b90c-9e44f9bed42d", "sighting--5ee8d883-850e-4264-821d-91d0f6a93032", "sighting--a55c3de5-a201-4423-b595-c9815fa5a03e", "sighting--a476195e-bee5-4070-993e-0a4696f9f1fe", "sighting--49d41ddf-3df1-4701-9c7d-f60239c209fe", "sighting--e7697277-2b95-4c7b-b8ff-948e8fc87d24", "sighting--7aaf962c-861e-41ea-a6b4-151cba78c3e8", "sighting--58ee1997-b357-42f8-8a5d-f298fec3e7c9", "sighting--48504b55-24f2-40d7-96d7-ae9b3c17860b", "sighting--a1c55a99-eb6f-4769-8f95-7fe4724b24b4", "sighting--621333af-561f-4ce7-ad0d-819808da4dac", "sighting--7782ea67-b21a-4b81-a9ed-eb994e26879a", "sighting--5d0e4617-629e-4f78-a458-19631e9767d7", "sighting--4124e1c9-d67a-4af7-a667-6c0e4ff4034b", "sighting--4d662e02-a7bf-4846-8d96-92eb37e85f8e", "sighting--155cd16b-dd51-482d-8409-e1caafa43627", "sighting--af2467f3-15e7-4388-93ea-b8ad51e92c7d", "sighting--83a04eae-82a1-450c-b318-44f8218af525", "sighting--1a56897b-51e6-463e-9203-771ea505b32c", "sighting--b56468d6-4cdf-4b00-9db1-953a391e7846", "sighting--50a395b9-dec5-4e05-90b6-1ae9bca83bb6", "sighting--d38a9310-3e5f-4f74-9160-e348cf8926ec", "sighting--295cbf96-64da-4561-9bea-821127934756", "sighting--f688cfe3-9f11-4fa2-adcc-dd133a6c98c3", "sighting--c7f42577-39ab-4e9a-aea9-e9bb32aaa85c", "sighting--8e494a86-9903-41d8-96c4-9fba1a304966", "sighting--4bc3896c-20cb-4a53-b57f-6b5b80d87862", "sighting--148eab2e-698a-4adf-a926-ce2597d1b039", "sighting--27aa65dd-16b1-426d-91e9-c2427df3ccbc", "sighting--bcc59bbf-84cf-4efa-9b85-15fdc150a38b", "sighting--fd8080a1-d891-4666-98bc-863be923b98a", "sighting--484b915a-8cce-4067-8f74-09eae4b468b5", "sighting--035bc1a3-0ae7-410d-b147-74e9489a99aa", "sighting--17085052-8c64-482a-98f2-7bc0b9c81345", "sighting--8c8fe16e-3e3d-458c-91ff-ed41ce6a091a", "sighting--745988e6-23cc-4160-a01d-231c83d3d504", "sighting--a7184625-fcee-4056-b16e-3dc03a4ce4f5", "sighting--87b7fe61-719f-4063-94fa-352f7f6e76c0", "sighting--66e33a73-123e-4a65-a1d6-5f5ea478967b", "sighting--f9be023d-c85c-4af5-a637-6b36178b717f", "sighting--24b929ab-8a7d-4c38-b180-afbfd16952b6", "sighting--35310647-b8a6-4346-98a2-9b98bf9b191b", "sighting--01d2fa21-a97f-40c6-8d0c-f52e0fdd9688", "sighting--fec72b87-bb3c-4c12-8085-bbb3c415cb47", "sighting--e0b4dbe2-d9ba-451d-bc28-b27f82909312", "sighting--e656cddf-9541-46e0-9459-fae05ae3beb1", "sighting--82794c0e-edda-4ef8-ba1e-3810117f418d", "sighting--a4662676-0136-477d-903b-82b2e2b3077d", "sighting--c403a75b-bcef-43fd-b21b-785e86a670df", "sighting--ad67e753-bf60-48d7-81bb-2d90bea0dab1", "sighting--035e4e53-fa18-43e1-bc09-b95e537bc54b", "sighting--0f3a7024-b897-49d6-9d5b-bee360fe8cb3", "sighting--c6d373ab-f79b-4e8b-baa1-3e54689c15c5", "sighting--acc1cfd2-5b99-4551-b9f5-f6eef9ed86cd", "sighting--9062d44b-f66d-41e4-9a1c-98b907ad116e", "sighting--2f89136e-a0ef-4f02-a9fd-c72ed733608c", "sighting--8292f5ba-111b-452d-a26a-ab9511664f73", "sighting--fe770cfd-fa67-470a-a94a-6fdf75dc8cf1", "sighting--2caad35b-3567-4076-ba75-b8c4ffb553dd", "sighting--f8dfa5b9-db17-4859-a6cc-93087d75a7c4", "sighting--8cd31b85-b6ec-45ee-ad1a-f3bf6bc1e052", "sighting--7e30da3d-d6fb-42c7-a5f9-f896b992d77d", "sighting--14bd077b-1d5e-4d71-a2af-80bbea044c09", "sighting--c42b61b1-a96e-427f-8779-a11f30d77c2a", "sighting--3ca5cfa5-5ef5-4e73-afbd-bd5f7875cdae", "sighting--d3c2f767-5b75-4218-8568-5a23ac3a259f", "sighting--4dd982bb-b159-4741-b367-0ccbd825b2ca", "sighting--0bcc4732-a2ca-4166-8820-98bb7d3c2d38", "sighting--20684d71-83d2-4ab7-ab51-1e845e64658c", "sighting--d4f77ffc-a0f2-4fc2-adca-531b8bf9a136", "sighting--aab0973a-96b7-4962-8219-6adadaffbd30", "sighting--b4ca861b-a20d-4f03-90fa-2df3dcdd3c53", "sighting--9dfbdc35-1737-4d36-a584-1cfe560da4db", "sighting--831de8df-7dc2-44aa-9208-2f9d5fd948b3", "sighting--d4d5d678-87aa-40e6-938e-552fd16474ec", "sighting--eb4d77f2-5bde-472d-b574-e9c1b180e427", "sighting--33162966-5bb1-4948-bc49-f1261a883b0a", "sighting--fcc2c55a-5e43-4ea1-b148-46a653d1ffe4", "sighting--b1b07553-b75b-421b-83b5-e162233a3fe9", "sighting--943ae0a2-2ff1-4067-854f-6e0a8f19e3dc", "sighting--29fef0d2-94a3-4cfe-82d2-65581eaa2932", "sighting--3055ddf0-69e8-4318-8c17-728c55e1ef2f", "sighting--f38f32aa-6c78-4a59-a657-79a4ab26ff3c", "sighting--af2afdb9-682a-41e2-a798-7176eb8b7420", "sighting--8d99a3f0-22cb-49e9-af72-f8620ed680ec", "sighting--18c47b16-b315-4de0-b3cb-5781836ec233", "sighting--2809d55b-0b49-4f53-b0e5-884e4dfae0ee", "sighting--f2c0ff3f-68d7-4b28-9e49-96888df8bed5", "sighting--f1563e0f-46a0-406b-897a-c6e65903f201", "sighting--955e69e8-1f25-463a-bb28-9df4ae6afc0a", "sighting--458edec0-f076-4ed0-b98b-60ccc3ea056d", "sighting--fa7b1dff-d858-49e3-9621-478d9449da80", "sighting--4c0b9a91-1168-467b-9fef-f9c728160c55", "sighting--f36f91d7-383d-4949-8ceb-0a92c9351835", "sighting--0feaabe0-77d5-451e-a876-f40a98b3e206", "sighting--98719a77-c5d3-445e-8a9b-4de7b11e11c4", "sighting--7e136fea-07ec-4037-a494-d74c47229e4f", "sighting--6343def8-c917-46c7-a526-580378dbc407", "sighting--6abc08d3-fb51-4a34-b221-4d87c479acc9", "sighting--2b331598-a7de-45a9-b416-531c15f92c11", "sighting--17eba9c1-8631-41e0-a96d-0418c1f2f547", "sighting--a8c9a9b8-0041-4350-81d6-be7a656ed512", "sighting--075dba66-9380-446c-86ea-05532e99e16d", "sighting--8cad1b3c-a895-45c5-b0a6-63685b3cc8d9", "sighting--f02cf252-df54-43b2-af82-ee07c6af06d1", "sighting--37274851-91b9-4234-b2f4-b3a240113e52", "sighting--851349a0-5dee-45fe-a8e0-ef85f8eace40", "sighting--32a33eda-e349-4317-b465-c7d6f8d8a690", "sighting--328d5bf2-070b-4562-add9-cae3e8c9c274", "sighting--86044988-5890-4828-b620-b48a9e15670f", "sighting--4a16d682-205f-48b5-845e-b893aa9c4475", "sighting--639fdd2b-b51d-482e-a2f6-ef062923c7da", "sighting--5908db96-860e-4461-a86c-7df68186d3bb", "sighting--096c3fb0-dd04-4b1e-8957-ce137dfc810e", "sighting--2056194e-b1d2-4f40-8418-5bc9447ef73c", "sighting--af395f4e-1986-48f6-8452-a37d82b2f84d", "sighting--b9ecc9b2-a436-4b72-9544-357a6d635814", "sighting--bc046f77-6ae0-453e-bc70-a1a10e5f9e35", "sighting--3052ea56-7e1a-4751-9c07-302238f0288a", "sighting--fb083589-d437-4eb3-8d72-ef3a733bffca", "sighting--7ce2f52c-7281-4877-8658-d972c61e2024", "sighting--a118e47c-14d6-434c-bde6-be8d1594e5ec", "sighting--b8154e2a-5984-4f61-9dd8-a9ba67461556", "sighting--7e00a006-6831-4132-bca6-cb7083ea621c", "sighting--2228d98a-1a8e-41a4-95cc-b07282c21799", "sighting--cf9d4a21-d9c8-4766-9de2-e91f4dfb299c", "sighting--2a8139de-8d85-456b-a9f0-2e1a770656fb", "sighting--5d1c8684-1750-4fae-86a8-898f755ccf41", "sighting--32f2513e-5027-4222-9692-923f71ca778f", "sighting--72d805bc-ff12-4a09-873c-67ae8d0263c9", "sighting--f5a23657-0284-4b39-b276-7024ff3374bf", "sighting--9e595794-0106-4abe-9b97-78ef9d0a434e", "sighting--ca4aa0dc-f769-4bcc-9aac-6e7f82153cbe", "sighting--f12eafdf-3b02-4d9d-964d-effd79871474", "sighting--f4547169-4a00-49f6-b367-deb01798faf3", "sighting--64a84c68-161b-4147-9556-cdf63d4f99ee", "sighting--57e9a1db-b5f7-46ff-b38a-3d5bef9dccf1", "sighting--8cb4755c-b94d-442d-982e-8a746470737c", "sighting--8180f381-9adc-4d1d-898b-0ab9c96cff4f", "sighting--6d97496d-ddcd-474f-a5df-1c075822c5c1", "sighting--3dad50e9-0093-4787-9fe9-5bc39889f206", "sighting--30979b8f-d968-4faf-b4da-c8be5f087faf", "sighting--5d37af08-954a-49b0-8f90-4fbc2f7db5aa", "sighting--d9574e50-ebdb-4e96-979c-6d8ba9da7558", "sighting--325b7479-f6a7-4776-add0-c508d1481b58", "sighting--bfe9202d-5e13-48be-a76f-8ad6d085c374", "sighting--b846d58d-1747-4a58-bff7-10156f1e2e08", "sighting--b41f16e5-3ea3-4a00-bd93-1b9aaddf43a2", "sighting--dc112556-0840-46ce-9a36-3ef9e9b86563", "sighting--1bb07916-cce9-4132-8cb6-aeb25919630b", "sighting--8901ca60-b222-46b1-86a6-03188b8dbd90", "sighting--1dba63c4-25de-43e4-acda-a4b5462ce67b", "sighting--86123de4-e63a-472e-accd-31dbd6e5d5fe", "sighting--ef5930b4-2944-499b-940d-5cc851ea4201", "sighting--1cecec45-2df2-484f-9586-4a1d3693c645", "sighting--e47d8b7a-34db-450a-bea4-309859f013d8", "sighting--ccd8a03b-9622-47f0-8679-0226ae9f494e", "sighting--9b04c9ef-ee91-4622-bf37-933ecd69c4f0", "sighting--d9752bfd-e1e5-49de-8f21-9adc9e5fb650", "sighting--1e415f6c-bf29-4e38-a0b3-1d6a8e6f9b94", "sighting--f6bf0450-fe00-4ab3-a9b9-f0b17237c8d1", "sighting--e1653716-1fca-4146-8c0b-a49ccd945e33", "sighting--67bcfff4-4e35-4f8e-ab2c-3c4e8d97003a", "sighting--0f6192a3-3779-4a32-b6e3-72f04837126c", "sighting--6291824d-62a0-4a1b-bfa8-dfb158e7cc9c", "sighting--644fe351-9bbc-4f5f-85f2-5cbfc2766a4f", "sighting--3194b94f-48bf-41f1-bd5c-b14300cc4e36", "sighting--0c1dad9b-d63e-451e-ba26-0baf646eba1d", "sighting--f4a3d889-23f3-4cbe-a94b-fa37edc3920f", "sighting--2e88641d-9ce1-4eb6-93fc-c8ab8da6ff0b", "sighting--114f0d5c-ecb9-473a-a499-5ef9e8d6403e", "sighting--1a70455d-5efd-4c52-bd83-e35067746a8d", "sighting--6cc47422-32bc-4059-9ce5-f10d888d74f0", "sighting--59d9b49b-2d1e-491d-9002-86a0cf8912d5", "sighting--1a99b4c7-a21f-4c0d-809e-64be7d094e21", "sighting--6922d25d-1530-4e11-9764-9e728b5d27db", "sighting--4acd98db-b254-4997-9f88-1d8e2a7a49b6", "sighting--b34e4da5-25ed-418a-af00-36fcb7cfb9a1", "sighting--19e12cf2-d970-47d7-bc60-ba75d71df545", "sighting--f662f2c5-16c9-4f18-b057-8ca993aae730", "sighting--14f15d30-9b35-4a77-92ba-b0ebb97f8ad7", "sighting--01a711ac-5ba4-4a3f-a24b-0da427d3fcba", "sighting--14f7c2be-3c08-417d-a178-38b2f1a02edb", "sighting--5cb274ac-f123-49b8-9a4c-4ed8f32f677a", "sighting--dd1d4d07-ac17-4fb5-8c1b-b88084508297", "sighting--9c089d2b-6955-4cdd-99b5-7cefcea1a4e2", "sighting--0abce7f9-2b9b-4cf7-a019-76a017c5f004", "sighting--842850a5-5882-4286-a2fb-aa5f25a71cb3", "sighting--49ff4420-f2cb-4c42-81a5-028513fd1b4c", "sighting--e46341fd-d677-4df3-af70-a4f58379b03a", "sighting--1ca00d5b-5447-4a88-86b8-91fa0fa39370", "sighting--ea983850-aafc-44b2-b11d-061fda01676b", "sighting--167443a0-42d7-4cd0-89c5-8ab42f58ef1d", "sighting--99466c1e-56d8-44d8-8659-e098e4555f86", "sighting--abd94a61-80d6-4c0b-a226-9d0b96e17a3f", "sighting--da43eae9-4a66-4154-83a1-c8acba738d75", "sighting--ce038285-0064-4806-879b-853b407096d8", "sighting--e0884c8e-1f23-4800-a29f-1b294eba1438", "sighting--fdd041b6-e829-464e-825b-ce2d1499056d", "sighting--f7114d91-5da8-4b63-886e-4f82cb7ef492", "sighting--08bc3394-6cb4-4bd3-ab13-d184bff53685", "sighting--8fee27d0-de3f-4a94-8cc7-191b5ad3ba75", "sighting--7a1409dc-0d82-4cd8-8b23-8bd10e1fa140", "sighting--9c6c3895-d675-4cce-9f0b-f76c08ca22e7", "sighting--bed7b616-fd97-4057-848f-5f16fb27ea6e", "sighting--915900e7-bc0c-4f07-b0cc-8303ee1b7f86", "sighting--702839e0-340c-48c5-949e-dc2c7cbede33", "sighting--1943243a-d03a-4c51-9bcc-690b1397b1e4", "sighting--5cec278a-4575-45fc-8f98-5fff94432023", "sighting--e69964a1-e16b-4a76-aaac-36d8ce6a7dad", "sighting--30e2cca5-ed3d-4907-b218-f58f98d58b9a", "sighting--74bca9b4-6f94-488b-9fa8-0282d1083731", "sighting--a7e25869-1d41-414a-b409-0aff7e12e1c1", "sighting--8dec90e7-fbd0-4660-89d1-1e3405561283", "sighting--fb8882a1-bfa6-4353-a1ff-451b4f146c81", "sighting--3df7967c-cb1b-4f8a-b6c1-d37b2ef8ffe8", "sighting--65bba965-99da-453a-a282-97b1f495ac7e", "sighting--285beb3b-4283-4d14-9db8-2bf8de64aa52", "sighting--85b5a718-b8a7-4412-83a0-a6142d38feb5", "sighting--ba1d73ef-a64a-4e44-9bfb-ad23c3ac4fa3", "sighting--913ee211-d4b8-422e-9756-af15712a3f95", "sighting--a461e937-eace-4afb-bbae-c00c46d2b1ea", "sighting--aa2f9dde-ea6d-4ee9-968d-9dcf38e03c6c", "sighting--323f1ec2-fb55-4830-8bf7-820eee7ec55a", "sighting--848b0cce-c818-4d4b-8dc9-3033d6119327", "sighting--fe784184-4233-4aa2-a58a-4bf170e1fff6", "sighting--b820c10b-c3bb-499e-bc47-5d650aaf32d3", "sighting--6f335695-9fe8-413d-8b8f-19cd9001288f", "sighting--0ba1cd61-8a84-4989-a54e-7cfdb655b62d", "sighting--5e5c6c4b-218c-4865-870c-4cfe75d9fedc", "sighting--40b49368-c26f-4084-8fd0-7fa9ad0b884f", "sighting--dd6dbec2-bbbb-4150-94e9-f036c869e50c", "sighting--2d97ba02-085c-4b88-8f76-7a68a06ab2ae", "sighting--d9d9d276-4724-44a1-b8fb-1a05da480e10", "sighting--fa7afdbb-192a-4610-b81b-b8b00045f061", "sighting--2f373128-d430-44e5-a4c5-b81c395daf7b", "sighting--97a9aa21-f4f7-41c6-a5de-7270c40cac17", "sighting--6ab36e87-400d-4f68-b022-eb0bdafa57d9", "sighting--f50a85d1-0465-42f0-969c-7cf999fe48f1", "sighting--f5101a85-aeba-4454-845e-82ca694a6020", "sighting--31699991-554e-4f31-a3cb-e724b15c42d9", "sighting--b9e67d77-4217-4432-a8e1-99ef17c6ca8e", "sighting--447c9063-6338-4734-a916-51488d577fd7", "sighting--2801a03d-4836-497b-b064-797120f76df5", "sighting--567ab754-3228-45bc-a51b-4beefc8f31a9", "sighting--325079b4-2c2c-429f-80bc-96fd6fba66de", "sighting--660ff96b-e396-4220-a91a-da157eee5b47", "sighting--e90f1114-dc1a-4878-b55d-ff03fb7f18f7", "sighting--3c949f56-0afa-4c51-8568-de110961de5a", "sighting--86c51c0d-ba2f-464b-a9c0-fea98c5292be", "sighting--ef5df273-ec44-4110-8be6-efdd83afb45a", "sighting--c9745cf1-1ab3-498f-8771-bb701c2cd1f3", "sighting--a05cba53-9e4d-4624-bb56-18947457b5a3", "sighting--9d46d033-f039-4698-aac5-6a1ac2886326", "sighting--314f2617-7263-4eff-9074-619690f29105", "sighting--8f1a2eb7-df37-40e6-a4d5-16eb4df7132a", "sighting--eb17a1b2-f557-4316-b62f-10f6be3280dd", "sighting--caaf1686-7114-4258-a3f8-22eab86ea0df", "sighting--9027c273-e47a-41a6-9a84-8d0106b7f2a8", "sighting--f23fd99c-5c5d-4276-9c35-48a9a0aca4d7", "sighting--9f1dc282-c9bb-4b62-8ccd-96e8bd439a50", "sighting--9ac2bdf3-40ab-442b-8435-767927ed228d", "sighting--f7afc368-f89b-472e-b682-cb910cad77e2", "sighting--579e37d5-5c78-4c89-b353-ab57aff6a49e", "sighting--e128a886-c9d5-4482-b0f4-2176779350c9", "sighting--98354503-a763-4380-807e-7206af29f230", "sighting--ce0ffcdc-940e-4b0d-93ab-3457fdb155dd", "sighting--1d9446c1-7d44-4b78-9125-de8aff37901f", "sighting--b9067eed-48a1-4ee8-94c9-5accbedf8e21", "sighting--4f797283-d05e-4a79-8d35-0a026421884a", "sighting--86eda5df-6a7a-4454-9a14-ec7c1f35f182", "sighting--00ce1571-3388-4e47-83a9-ee9b2da2859b", "sighting--f29ba91e-a9dc-4f92-8b22-5f88afc176c2", "sighting--ad64b498-3050-4817-996d-4075781720e7", "sighting--de2aabb3-b094-4c53-8c97-11fed1dbdd6e", "sighting--bc09a12f-e539-4b82-bad2-a0fef5bafe6d", "sighting--ed88ecde-788f-4c8e-a1cd-9b4b57ab6dec", "sighting--58358a42-6e93-4b2a-bac8-ff434be1639a", "sighting--72182fe0-13ed-4b3f-9752-afd6e27dde62", "sighting--991076e5-9de5-4e93-886b-93d7bff80bef", "sighting--2316a223-8227-43b0-a887-5d2bdba819a6", "sighting--7badb9d4-199d-4357-8d72-e29f4858c289", "sighting--053d4632-dee3-45ee-8fdf-5874d4243189", "sighting--b16ccd84-a8da-4dcd-8fbc-5210511f7c06", "sighting--fe0c2822-5717-40ec-ac69-bc540dc41306", "sighting--85579639-c953-4b6d-8679-7d502018a9dd", "sighting--ec053d6a-135f-474b-999f-4fabbe374a76", "sighting--15e41d6f-807b-4936-b196-cbc8ce55cb5f", "sighting--78e947cf-0228-461a-8f1d-7eeb943a0a10", "sighting--b75978c8-a895-4ed6-954d-888b0134ba70", "sighting--f8d8b4f3-50d9-4380-8e59-05deec8e3b72", "sighting--f65bf383-b605-4494-a7aa-3bb4e01e9747", "sighting--c4abf847-bf92-4009-88bb-318fff7a20f0", "sighting--246273a8-c27a-4f13-80db-955dd6163b7b", "sighting--9daf9dca-1c4b-4d35-96bb-2ca7ff3f009d", "sighting--7389ab52-70cf-401d-8885-682975e278a3", "sighting--1f1533a9-c863-4871-b221-9a0c06064970", "sighting--4d45089b-6eb1-439a-b883-dde01ce41d61", "sighting--7156afac-4291-42e7-9983-f25430964aa5", "sighting--f72a7f0f-971b-4c15-8c66-259e735515ab", "sighting--4791deca-6c24-4aee-a8d8-a507656648c4", "sighting--e5176d9a-7a0f-429c-b05f-3e7890baf24a", "sighting--199ecdae-694a-419c-819b-abf3594d328d", "sighting--3d11c45d-28e9-4b8c-83ec-ed387ddd10e0", "sighting--d1532a7c-6cfc-42bb-8bc6-dcda2c155548", "sighting--857f418c-c79b-471b-88a8-4e54f0bed82b", "sighting--76ca96bd-0c37-4775-86d9-59868de64e5c", "sighting--40bc9244-1798-447c-871e-b184b974e0f1", "sighting--d9bec550-3b81-4bdc-a66c-ecc927229dcf", "sighting--e51ab3e8-898c-483a-80bc-d995473bb60f", "sighting--f0159d44-bdc5-458f-a571-d29b580dbcfe", "sighting--972e5de5-3d39-4bc2-8b94-01d97f4c6ca5", "sighting--5c3671f9-d82f-469c-94db-c2f612c5e694", "sighting--ce8191fa-8671-4280-bd31-a3c09fc2bfc1", "sighting--652e3ae7-8f03-4a0c-9a2f-6ee5acdfcb2c", "sighting--0bc278a5-99da-46d8-aabf-0363d67c6fbf", "sighting--a2d21077-78c7-4d91-a251-a58edc3fb08c", "sighting--71920ac9-9abe-4edf-ac26-5967365ccf1f", "sighting--68a47997-f9e9-4776-b975-441db38620ba", "sighting--1769bfd0-2489-4a48-a3c4-5a08eea1df1a", "sighting--9d1c905a-3cfb-481b-9800-07dc68b316a1", "sighting--44ea73f2-4210-41e8-a2f7-39dcab447eba", "sighting--2c9074ec-c7d9-40dd-9815-cb66e49fc767", "sighting--4aec18d9-cb43-4ac2-a691-2a287d6985cc", "sighting--64c8d2fb-a600-4b32-b981-a074033342c1", "sighting--1cc03b07-c86a-499a-aa3b-a37c5f5ef4f6", "sighting--f940cc25-5de9-4518-90f9-bf6e26376eae", "sighting--04c9ca88-b917-4d8a-90bc-05bdea588e7b", "sighting--914e48ac-f76d-489e-a136-be75de63beeb", "sighting--70e2458a-8b0a-41b1-827d-38df73d9c630", "sighting--030995ae-28b0-4c56-b5c7-5c352e6525bb", "sighting--798f8d36-efd7-4fec-9d22-007ff1704f1c", "sighting--31463a5c-fe9a-479a-87a0-2d6ff3ff3972", "sighting--63715e66-cef6-4787-8f25-353fb00569e0", "sighting--d676c5dc-75ca-4566-a3e7-c7fb9df4092f", "sighting--734c0061-c820-4a80-8a08-e1da6b8f5fd3", "sighting--950a7f61-0579-44f6-b662-5384218adcef", "sighting--df258a06-8bc8-4ef2-a660-d838d624748c", "sighting--a475ed63-ded4-4a7b-8d3e-500b8a68efc1", "sighting--ec64673f-592f-4482-9f73-a44a425382cc", "sighting--27014aa6-34ef-495a-93be-7c83576c12a4", "sighting--0097ee35-9aac-4f9d-adaa-f9dce0a767fd", "sighting--22ae347e-72f1-4994-a089-5205e3d449ac", "sighting--5eed76a0-fb12-47bb-9844-0aa0ad212ec7", "sighting--9b519325-182d-4a41-b4b2-3276102363ad", "sighting--fa7150c6-5117-4fe2-b14d-9c9a7552fd81", "sighting--00fc5033-3cdd-45a3-bbc6-4d1dd5b57695", "sighting--01a916b9-ab10-46c8-9134-33bbbeec33b0", "sighting--fe5e6acd-bf28-483e-8862-ef84c853ba12", "sighting--d8588682-b0e0-4d49-b931-fa9a459fd10d", "sighting--6ef4b4f8-8c33-4645-8224-855402c3acd4", "sighting--14e9fdd2-cc5c-4eef-8c46-649d670886b6", "sighting--47491613-bfb0-4579-a752-dc54e6ab8269", "sighting--0118b633-f47f-43ed-a425-f85a1f9c1f51", "sighting--d1eb6c36-45ee-472f-9d5b-9d541e43c230", "sighting--8a7d8d87-6de9-4b72-97f5-663ede9d0333", "sighting--e8e7c349-ef05-483b-8894-daac0f7b6685", "sighting--b65e15e7-f96d-45c5-8a7a-e7a64e012dd1", "sighting--2610a4ea-1eb6-44fc-acc3-442a0168147e", "sighting--897d3b48-d7dd-4c3b-8f4f-25eacba4bbbc", "sighting--8765497a-ba2a-411b-bb07-9cb86e5cadcb", "sighting--8619b689-5fde-4d4c-af4a-b51af7769388", "sighting--fab81023-dd6d-43f6-98d0-3170e3235450", "sighting--003ba3cd-81d1-4489-9a61-680b624e353d", "sighting--d75a78a2-4422-4c9a-b4bd-961c49d9c8f7", "sighting--f09df57c-e7cd-4077-8635-c798028dbb6c", "sighting--bf37ce37-42c3-485d-8e47-4c93ca7f5673", "sighting--95d1275e-6a14-4bfb-9b1f-a42fec3634d6", "sighting--50c9a2b2-63c5-4e1d-862d-59c88c65d3b1", "sighting--58e27b92-e0f4-487d-b81c-08822ccd9a1a", "sighting--a48b038a-9d2f-4839-849d-808cc8fc7edc", "sighting--b36eb25a-34ec-45fc-ac04-0357f85b41fe", "sighting--e91d001a-49c2-45cf-ada4-7d9f87c87c84", "sighting--2f5f7cec-e0f7-4be8-9090-d1b56ce2ce31", "sighting--acc12939-0687-438d-be10-b5129010e173", "sighting--4391803f-d0f1-458b-a8d0-868148f31da7", "sighting--7eb32e53-0641-4d06-9e90-1c789e0bd38a", "sighting--c53ec9e8-50fe-4985-9327-a01b8b4a8fe2", "sighting--7d3b3dc6-294a-41f5-bf8d-ca87c40a5ed5", "sighting--b734049c-63d8-45a4-aa0d-5b705e275f4d", "sighting--f6032aa9-0f55-4e3c-bbb7-c4f43a78f1f0", "sighting--3c32fb6b-f847-4007-ab7d-86b6808b8385", "sighting--9fe20007-a756-43f3-9d5d-c1320888fb76", "sighting--a6660edb-c53c-4fb9-8c05-94ea838ceb4d", "sighting--dbfdeedf-1fed-42ba-a038-8ee58ea6f9b2", "sighting--ca16cf34-8d5b-408a-b884-a593f841782b", "sighting--c33279ea-0e4d-42a4-b4b2-dd830c419248", "sighting--2458df88-5478-4763-89c7-7370729bd524", "sighting--271c90c3-4605-45f4-a2af-821b916a32ac", "sighting--b2b1cadd-233a-4567-9403-ca3fbf58affa", "sighting--4179b9ee-c7a9-4faf-b0ea-c9fd0f0210bd", "sighting--3771d819-a0cc-4182-beb8-d8c4c02b6e8e", "sighting--d6c46021-e6ee-48d3-960b-dcaeff581176", "sighting--08d3d096-f287-4def-b1be-d2035e117acc", "sighting--9d9c0885-f7db-4c57-b08b-cafd040bf163", "sighting--3b5aef3e-8e2d-49b3-8b50-07563c37ade3", "sighting--651fc9e4-057d-435d-b3f4-9c998eefdd28", "sighting--e68432f6-ce3d-4c85-afd6-2c0acb1afea5", "sighting--74021f3b-9bac-49d3-9948-f2458712e449", "sighting--40b807f6-3af0-436c-871a-7567a18b1144", "sighting--616c24d7-7f5a-4752-98eb-bc8fbf889784", "sighting--4b2d1888-0700-4e17-831f-e205eed550a3", "sighting--2c5a51e0-c4d8-489b-baf9-d89f34bc710e", "sighting--1db4be97-3e41-4670-ad77-e869e74ebe14", "sighting--3db8ced0-e9a5-46a9-9511-03b1dae320dc", "sighting--251781dc-4eb2-4395-91fa-74fe3d680af8", "sighting--1674c62a-9313-4bcf-8133-b6a7853123c0", "sighting--11c07b60-252b-4f14-ad0a-9c362afed406", "sighting--4cffd8fd-ed6a-422c-bfa9-3b0dadf4b760", "sighting--6a277087-31ba-4af9-8490-580f8bbb2536", "sighting--84e36894-660c-4a7c-a813-04e662e0cfbb", "sighting--611bcc56-8dbf-4ad0-962f-b790b067cd00", "sighting--d5fb335d-8738-480d-9129-61cb2134037a", "sighting--cf2508ec-f49a-4e35-a11a-4acb58d09230", "sighting--ff07172f-e839-4ea7-9379-0daf284a9852", "sighting--7c4a3ead-f382-4e39-9817-5a86fcb5c750", "sighting--d346146b-4a2c-41d4-a766-0a7dcda713ef", "sighting--3346534a-12ec-4a06-a901-1a931ed04a3d", "sighting--c5e5e36f-3753-4f0f-9ad2-52cefcf9cb82", "sighting--c32a404e-03a2-445d-9f8f-93764975f837", "sighting--f3093d86-779d-46cb-958f-f6a3b8d61371", "sighting--fd830dac-2d1a-4c05-9048-c5cb6efcb175", "sighting--10a10a6b-1bb1-44b4-96f3-a086e447e77c", "sighting--3d7e1407-adf2-4342-b7d9-0e5934bd42d0", "sighting--def47f23-b14b-42c7-8d42-8a2563eb2c9a", "sighting--6abb1f58-afb5-4abc-a233-8cff120728e6", "sighting--ce200bf4-65df-40dc-a376-41c8aaa8725b", "sighting--b153b8a3-4e2d-4dfe-ac6f-827df9439bd5", "sighting--0658c904-f227-431a-959d-d60afdebfdc7", "sighting--0105ca20-27cb-4eb1-8a82-1a68906701f3", "sighting--2adcb813-7361-4911-b40e-328815bd34cc", "sighting--7aa82134-f0dd-47a2-b0aa-25c42becf8c4", "sighting--12d2b81f-0945-4b32-bb2f-b0d04230547c", "sighting--918af109-8ea6-497a-81ce-73385173e529", "sighting--22b9eb63-cd5c-47b3-9e9b-622c7a5a006a", "sighting--48c2670e-deb4-4777-a3e7-e9326c28c09d", "sighting--3ac7413a-820a-4594-aa18-bb08c292fcf1", "sighting--54935914-3da0-43f8-aa29-386e1e0a4a65", "sighting--0d175efc-9b7c-43ac-aaca-736c3722115f", "sighting--991dd878-e171-4d79-9e2b-2deaec824af1", "sighting--cf884993-daa1-418a-b463-9c60b70eb4fb", "sighting--5f25ca12-a9f4-4fc0-b997-4ff847326fc3", "sighting--50787f66-da4c-43ce-96f1-381c69c49d34", "sighting--1bd3fb17-032e-4ebc-bb9f-e96dfa2b35d0", "sighting--ad988b1c-6d45-442b-acc9-657e1a01de54", "sighting--5a21f626-29a5-426b-960f-5a8065f6ec55", "sighting--387ca5c5-ea56-4bc9-90eb-dccea3e5c3e2", "sighting--22f0195b-8a1f-40fb-9286-053bce26bb02", "sighting--f028d4a2-5d0f-491a-a41a-ff6e13029e7e", "sighting--a3efa038-5a80-4989-be04-17256021b05a", "sighting--ef63490f-5758-4da8-9209-f51d17728534", "sighting--218effab-92d5-4230-aa0b-50420c658a23", "sighting--10f2d8eb-3d03-4070-81da-2f18b8e47047", "sighting--9148606a-80f6-465c-a273-e98a8da178ee", "sighting--f8c9636c-de67-4613-afd6-32ecb1d007b1", "sighting--ca3399e4-2ae1-4780-819a-f49e8e164cbb", "sighting--609b8242-6466-4eae-88dc-cc013b04f19d", "sighting--4bf1afc3-17e1-410f-85b4-aba9967a978a", "sighting--ed44c844-23f8-4872-9489-d661e1665e23", "sighting--367aab4a-9785-4550-bc13-8a71634ee4c7", "sighting--b2a04a54-95ed-4028-8a42-a5238358ab40", "sighting--9d8d1eab-2dd3-430f-be9f-56de57f97293", "sighting--b98df380-7a02-4ebb-a2bd-a10bad66a67d", "sighting--8bf72977-c7ff-480c-9aae-7df8d54efb22", "sighting--2c189383-b1dc-422f-81d6-c03a32d83448", "sighting--aeaac1bb-9ec4-4beb-ae93-03d65794eb88", "sighting--2527fa3e-172b-4714-b234-cd88af2045e4", "sighting--083f2713-8e59-475b-98c5-5c418cc57635", "sighting--7f738ea0-45cc-49d9-b8dc-e80ccab28391", "sighting--72881a1d-b89a-4daa-a845-3451d646bae5", "sighting--47939831-773e-4b27-a3ec-5a933b63150b", "sighting--ea933c1c-8771-427f-a191-9c4532fb9aa2", "sighting--0432963a-6713-4d8b-b91e-e06d5fbfe8ba", "sighting--93bcc828-8365-4700-9d13-9858a125f892", "sighting--7ecf9a1e-de7b-4590-8d50-11afe63277ce", "sighting--c4244772-0ebf-495d-b6a8-be165c46e94a", "sighting--fab0f9bf-80fd-4473-bc84-bbaafbb424b7", "sighting--76c98923-8d2f-4640-8c43-95c91d745945", "sighting--4d9c4915-50fa-41b3-800e-f965f49cad49", "sighting--49ea7ba4-b752-4c23-a92b-1ff167e80c07", "sighting--84c498b9-1a90-46d0-b34f-722cfd72e61d", "sighting--096368c5-c203-4f7c-9fe3-f70ce818fc54", "sighting--57d17604-51c4-41ad-8acc-47a90d8c39f8", "sighting--d41e166f-d100-466f-88fe-56ba85508870", "sighting--7b1305d9-18e0-4a1b-8e9a-c2c0c528466b", "sighting--a6eaa56f-8577-4e44-84bb-80af644781eb", "sighting--b9efb7ef-409f-41a0-ad97-f9d26de99620", "sighting--ef12c1aa-2013-47d3-a2b2-66c901c2e6f5", "sighting--fea218b4-e739-4584-8091-ddf1abc3b9fb", "sighting--f98851fe-54b9-4ef4-b2b6-a715307a84fb", "sighting--98feaa52-57cd-4473-b629-13064c75effe", "sighting--9f075600-7128-45a5-b6a8-aa30b5465c9b", "sighting--fd247fd0-e3fd-41eb-ae7b-62ae3dd44714", "sighting--342c92ff-ce0f-49d0-8e76-23659badf4d6", "sighting--3d05e929-e877-4247-863f-256607a62d05", "sighting--4ba3ce4f-734f-41da-8821-500a68ffb88f", "sighting--1bde828b-6c0c-47fe-a973-d24835dbb981", "sighting--6702c144-c9df-4bd8-a60b-cc319047ec30", "sighting--8a607b78-4ed5-49f0-b0b2-a62a3134307c", "sighting--9c27df87-0d4c-4c50-a2fc-5c9fcbf17995", "sighting--8cfbc3ed-28da-48bb-877d-55cf268bf8ff", "sighting--4f20aeff-f10c-47b7-944b-06e2ba4e5175", "sighting--66c7e80c-f80e-4ee2-bd5f-a8c92ba710ad", "sighting--5c656c78-d491-48d1-b260-39ec911ac0f9", "sighting--8a34275e-8288-438c-a79c-404f25bb0173", "sighting--5ea5bf83-6a6e-4023-a8b5-26f3bfa32e42", "sighting--a3e87422-27f3-4260-9c19-7ad3833a7e26", "sighting--01a1dfd3-5a2d-4be2-8274-1a60811ed8b1", "sighting--bda8f5fd-8e6e-47e5-ad7d-d7342ff9d83b", "sighting--5ac5bca2-51ef-4dae-a13c-adee5af1c4b1", "sighting--0f4c0887-a2e4-4e4a-b055-d614ab62ee80", "sighting--719c7d46-85f2-4497-8e26-7c57bde77fd1", "sighting--cc67bcab-f79d-4be3-a002-1480dc92888c", "sighting--5cb3e017-ff35-43ac-8ab9-1a73c850d658", "sighting--40791124-fce1-49d0-9587-5b85e4e9c709", "sighting--71f83427-102c-45df-9103-7d7e65c9d32d", "sighting--d119e5f0-93f7-4fdf-99be-cd401365f660", "sighting--38ff42c1-17bd-4b60-9cd8-440382d8ac99", "sighting--07cd9ccd-5810-41b0-9325-d14a95b92d47", "sighting--15890bc6-8ce6-4696-b69c-f69bd91a6377", "sighting--f3b928e6-3064-4bfa-9e5c-177f08d94ca8", "sighting--4f533086-c075-45b2-9553-38bf5490356a", "sighting--95678784-2e53-4880-8db8-29768ec68102", "sighting--7f922104-2c3d-466a-af68-b2b570e12a48", "sighting--d893f2b1-4c3f-46e6-958b-a88a240595d9", "sighting--19826a45-264c-4647-82b9-fe99e3095909", "sighting--68cc0680-8a6d-4885-965b-c3ef240f770a", "sighting--82137e52-f1d2-439e-b429-da9b87207016", "sighting--e21f1df5-1eda-43bb-9b33-6f6544835b75", "sighting--f4aa57ac-5d3c-41e5-8352-ddca71a9819e", "sighting--1b1edf00-6ed9-49f2-a016-50bda55caddc", "sighting--898747f8-1b26-4e31-ab60-e7b2fb1a3846", "sighting--3c08c4b9-b977-420c-839b-f0519e76963b", "sighting--d6f56d16-f055-49c9-bd79-175b689b33e6", "sighting--2ca1f17d-a4f3-4801-8fae-ebf68c1c6dfd", "sighting--8d121205-0e8c-4f23-9a2c-06d54f7700dc", "sighting--aecb6349-6ac9-4060-9525-b4861499d3aa", "sighting--55d77a38-a2cd-4323-b2fa-dd8abb23d33c", "sighting--1b909b58-ac21-455b-92a1-88c5355fd02e", "sighting--01fb5314-c72b-467a-85cd-6849904a1e83", "sighting--cd2b291b-ffc1-4004-9d4d-e5629b38554d", "sighting--547c9ace-7114-4e12-b3c8-c2156ab55de9", "sighting--48fd03cc-eb78-4aa3-875e-8bc1aca5e4a5", "sighting--2ce59947-3a12-4917-baa7-21258cad7dc1", "sighting--d9750823-f4c1-4e00-93a7-d4b7fd54f444", "sighting--5d07f22b-8756-4421-848b-3767ec8712d0", "sighting--668ce591-449a-4f49-bf38-b3f3bda7f059", "sighting--383ba1d1-1273-452f-8c09-946d2289595a", "sighting--e62c57d9-b133-4f0c-b4fb-13ecdbfded8a", "sighting--738ea762-6b24-4b0e-bd84-e689c2a3a214", "sighting--3599eb02-f35f-43f6-bfaf-f0ce84a99998", "sighting--3a672e60-15fc-4036-a3fd-17d18a47f811", "sighting--3416e295-5204-49ba-aa48-02d657d78731", "sighting--fcb578f0-9f8f-4265-aeff-e2c806dc8c50", "sighting--ce6b20ed-ebb1-49f3-ab7c-08768fe7dda8", "sighting--ca6c788a-8492-40a3-949d-6bb6fa9b570b", "sighting--a622fb7e-5519-47e8-aa0d-4893839d8cf7", "sighting--05523f51-5db5-49ba-93a5-2848be581e30", "sighting--c16fea3b-db2f-4a1c-9dfa-ceaebf1476be", "sighting--747fdd15-e256-4b30-a1bf-dd1ebaf766b6", "sighting--df6ed66a-61d7-426c-b1f6-39c93266801d", "sighting--f7bbea3c-eea5-40d0-bb37-5d9e336d022b", "sighting--cd94969e-61c3-4e46-b149-e4633ee07d1e", "sighting--4c90b243-a6c0-47ea-8ec4-496a1401a67c", "sighting--e52f0284-b796-48db-bf6d-3eb67de8e4a6", "sighting--e8612f41-23cf-4833-b869-2d8cd5f50126", "sighting--96ee95bc-5a40-4fc7-a34b-5a0043cbdc5b", "sighting--4d8ffc02-da83-4237-b2bc-2fa64d50c1b1", "sighting--a6e5e3f9-7075-4c0f-a4c6-1e119f563127", "sighting--05d2e1d7-f113-4a2e-aaa4-8a5ac4daea0a", "sighting--67ad86b6-9aac-4b29-bde4-f9b53aaccdac", "sighting--0eb25763-93c9-4e4e-8ca8-e951c04e538e", "sighting--643120d6-1030-48af-9060-42f4d4a3bc7e", "sighting--d7d3cc60-f1d4-4aae-8d66-57f414502861", "sighting--35628cdf-9af1-48e6-a6c8-1cf6a09e6f2b", "sighting--0e83b4f4-5dba-4f49-9d4f-cd9a33037bd9", "sighting--d0452b34-4731-490a-ae54-a7efba03a384", "sighting--b94ca703-3c12-4c78-b037-29661259e4d5", "sighting--51ccfbbd-fe9d-4bf1-af01-fda6b4d2abd3", "sighting--7abe8717-c0bf-4486-81c4-78024d2a8501", "sighting--c34a9fce-05ac-4e24-b8cd-c043572a7768", "sighting--e1daae36-4386-45bf-aeb6-693acf47a773", "sighting--357ffb23-96dd-433b-b35b-f1b1aa29cc12", "sighting--017d37e3-5b26-404a-a885-8d04de2357e8", "sighting--3fdc708d-29ab-4dff-8a81-38bb696623cb", "sighting--f7d9020e-83f8-4d76-b28f-7de14aafa25c", "sighting--6fb37266-9458-485f-8325-2d9ad448cb8b", "sighting--55c2e5ed-8d5e-4ed1-af8e-c192a25d27ff", "sighting--b7b8cf8f-92bf-493a-bc0c-b17b3ee6aece", "sighting--b55aaf6c-ac2f-4d8e-b229-4a89d85737d9", "sighting--6a2261b3-c594-4f91-bb85-2e8fec72f91d", "sighting--3f2bb40d-ba86-47d6-ad1a-f083144229b0", "sighting--c7325dc4-bba7-4093-b02e-db102547a339", "sighting--73899b69-6a17-4048-b868-a7c4729178d9", "sighting--39071d30-65c2-4a92-b6b5-0d890273619f", "sighting--2af1da11-8b77-4098-9dec-75ac718ad582", "sighting--38c57fa1-1961-4c91-a610-99d17558e12c", "sighting--c45f6617-ceb8-456b-a663-0a8fb1bd9c05", "sighting--58dc7f1f-c6c6-4eaa-8a6c-d8ed15bb88cf", "sighting--774be88c-6a43-4537-b8fc-0d59f2f033c0", "sighting--ee9be481-b5ad-4a3b-a7f0-309390860492", "sighting--c1867045-9336-4e2c-a408-856228548bd9", "sighting--e73add48-78c8-4699-b50d-2caf913cd9f9", "sighting--1950a9f9-c0aa-4e21-b41f-937c5cedbe69", "sighting--61da87e3-5eb1-4634-be5c-77c419955ce6", "sighting--bde50c05-08ed-4cfa-a840-4195ae3ffd47", "sighting--b79def63-7f7d-42e3-8008-36f89b0f8d06", "sighting--cd07a03d-2765-442a-aa3e-a961bf8732b2", "sighting--724df68b-bec0-43e4-807c-b170d0080694", "sighting--2687831d-71df-4758-9632-5abddb1d53f9", "sighting--301033a5-0ef3-4777-a062-e635eef5c183", "sighting--0097f5bd-3e39-494a-a373-a80722c9443e", "sighting--4ebcca58-c3b4-4a3b-b596-7dc636e622a0", "sighting--5351f14a-ba26-4bc0-b73f-644889e9fbe8", "sighting--8c5371fe-9f12-4475-b7e7-030bb4e1ea8b", "sighting--6fe6c75c-a48e-4d28-b80e-f03f561778f2", "sighting--34a3256f-4c86-4fb8-b124-d966263c8819", "sighting--d0421871-2051-4ad9-ac79-8df74dcac357", "sighting--fb5b28eb-9730-4880-8716-9ee2d19dca25", "sighting--7ab0b012-0ae1-46ba-8f23-d0680c441365", "sighting--1ff6209f-fc5b-49f0-92ca-a6f992c66980", "sighting--6dfcb517-643e-4153-a604-edcd83c22713", "sighting--13cd2d79-cbd4-4db4-b135-99eca531abb0", "sighting--be54371b-99b8-4462-b4ed-f90179b0a159", "sighting--edeedfd5-f2d1-43cc-872a-6e3ba0ad0bab", "sighting--495d3099-9096-42ea-bae6-5d060a475644", "sighting--27b90a52-cca9-4caa-9ad4-8ede43327455", "sighting--5f5ce7fa-89e4-4ace-acb2-a5c5eedf8576", "sighting--987805c5-297a-4cd2-8aab-602d4c828360", "sighting--0fbf2c58-b614-49f3-a484-f394e2103b1e", "sighting--03162db0-03ca-4168-a8d9-688c1e9a52fc", "sighting--2a692edf-1a27-4a38-91c6-f58ba00eac39", "sighting--a59706a1-6fc9-4ff6-8897-fb5f31d881f4", "sighting--b78c7698-bbe2-4bf2-b7f1-1b0d509299b7", "sighting--1e2d1c83-c071-4666-a91e-b10e25f119f2", "sighting--bcbf090c-7a82-4e22-916f-b0d8959866bd", "sighting--30f3f1e7-e869-4860-9be5-efe73ea2858f", "sighting--38192d57-2a86-479a-a327-cba31cd9943c", "sighting--6d1eeace-2edb-40b5-8b96-8546a46e9f55", "sighting--7bbf3627-a480-4439-b17d-911daf020c3a", "sighting--c03efba9-e0b5-468c-93b7-99dc5311e834", "sighting--6393fe4f-647a-4599-8d7c-e0cde1cafca7", "sighting--cd12e1e3-d5f6-41c9-9f6b-771cb4eb6ae5", "sighting--6a4c4eb4-344a-412a-9ba1-c9af971bdc4f", "sighting--c0352a01-919a-4e7d-ab8f-0ccf077ff016", "sighting--9c370f16-6b77-4332-8ac1-0790831de1b9", "sighting--943f9775-9ae0-42a8-b802-63fa4c317440", "sighting--7e49d97d-cd01-4bf1-b534-ac93043ff587", "sighting--0d7ee1ac-703b-4b45-8ee6-0ebd2cfb6a91", "sighting--f6ea9981-5a25-474f-b645-735786ecf951", "sighting--60389d46-9061-4ca6-a588-7ebfef95b32f", "sighting--4eeb0d7d-66e3-41bf-9b28-331813d42874", "sighting--1bca23b9-0490-4c9c-bb1c-d7dcc9d634ed", "sighting--342511cd-4eb9-468a-bdf6-05e5256db51b", "sighting--6cca0790-6bb5-41bd-81ad-d932ea698aea", "sighting--b0a58aae-a9cc-460b-9426-0c295b0e5bcf", "sighting--e4cb3d8e-8517-4496-9f8f-e2cb62572a42", "sighting--06caa408-37d6-4492-b604-ea33329776d1", "sighting--69044cdc-41df-41ea-9935-529c40bb253a", "sighting--1bc74d4b-bb2f-483f-970e-ace09c75429a", "sighting--bffc916f-a520-416a-9eda-c80b77242704", "sighting--378bd278-afcb-4f1f-92b9-b18116854e6c", "sighting--4983b602-23d5-4392-8c44-468e7331489d", "sighting--214855bb-692a-4629-8a10-4acdddfc4bd2", "sighting--c5f0938a-6f78-4d50-8835-659bf85fac93", "sighting--e759e132-1d65-43dc-ad89-cc8d7eab6c27", "sighting--789df7fa-c7e4-4640-87cf-c5c221ed70e8", "sighting--92ce6d7a-392c-4738-8cef-204b6d12fe43", "sighting--b9f9c7ce-efcd-4d32-8305-42754f4889a3", "sighting--1c9c705f-d081-4177-8ba3-569e85a11108", "sighting--4999b238-201f-4360-abfe-9960669b1cbd", "sighting--9ab5f5b4-2dcb-4239-8451-2c1bbae87861", "sighting--01bf463e-1a55-4e77-b88b-587bb584d00f", "sighting--e4673ca0-42e6-40fb-8eea-7e4d97213387", "sighting--177d0165-4d5d-4324-aab0-2691ec1d5ff1", "sighting--8c389622-b51d-41e0-adf9-277ef9cd9050", "sighting--e7756d37-12d8-41fa-b67e-7433ac3262fa", "sighting--038cb43e-88da-47d1-9ee2-d8981b65593b", "sighting--fd829d5c-c551-4c31-a800-8204d07b24cc", "sighting--b3db8c73-f979-4ec2-af94-504eaf3d9c8b", "sighting--1ad1f385-dce0-4c63-8fd8-cefdaf06cb5b", "sighting--7d1e0416-d5c2-4089-a9bf-f91ebe78bab9", "sighting--3a71b4d9-3b7f-4478-82a2-1b3411520256", "sighting--c5986a76-cabd-4d94-939c-0a172c912264", "sighting--6a3dd50b-4d98-40e9-8e73-0890966bf725", "sighting--72a8a15e-6a5b-42fe-a0a5-60f103e32397", "sighting--11a0bd42-2c75-421b-b812-612406a00477", "sighting--98578c8a-1520-4a1b-b2db-da81fc261a94", "sighting--481b1d40-93e5-4d42-9bfe-872d6f4adc68", "sighting--7fda7433-6164-4afe-9587-a8d62d3f0b6c", "sighting--c24ae8f7-f648-4169-8ab1-5aef2cfbc1aa", "sighting--f87366a2-df74-4d68-81de-ac8739d3f29a", "sighting--76bdceb4-6a23-4cba-ac7a-8d83d60a22dd", "sighting--829bfb5c-c9f8-46d0-b98c-dd3b4536cab1", "sighting--0dd74c51-d469-463b-8d4b-5699af30895e", "sighting--817555a7-09ec-4098-82de-abdab8721fb9", "sighting--15e2d447-8d2f-458d-a264-092eb8fb7548", "sighting--4e37dc5d-fa8b-4985-a730-df673144831b", "sighting--8c7061f3-bd4f-482f-af82-f62f147058f5", "sighting--da1f18f3-1e5d-4298-8e2d-dbd2db3f2a3b", "sighting--34c7ba43-d55d-42d9-b762-adcad1269269", "sighting--9b92e8bc-f5c6-492c-9c73-f191932bd923", "sighting--62d7d828-f1c2-4bb1-b0dc-15f98b3be422", "sighting--729aba79-c2b0-4bc3-845c-1161e4f10b06", "sighting--e6605f0d-0e01-44a2-a932-0457f5d8fb19", "sighting--9f210063-ce5e-42b0-9e6d-b059459be3c2", "sighting--b1aae4ad-1592-4b69-bcf5-2998a762620e", "sighting--0e5cd913-ea72-4b59-a6a2-cc148cea9a1f", "sighting--cfffa114-4a67-462b-975b-1b19e55a9c31", "sighting--555ba487-3305-4a6b-9507-f0a7d7a55dee", "sighting--ea3a0d72-f763-4bed-bbdf-b12372912520", "sighting--5a4fd784-a734-4dc9-8ea1-d591ef8a22cf", "sighting--f3a61576-7dec-4cd0-841a-1f76a3367a5d", "sighting--9eef517c-d8fa-4a06-be7d-c5ba1173c68d", "sighting--465781b6-2030-4e86-ae8b-c9a496150d4b", "sighting--4b714410-3036-43f5-9269-36ad7dbb1afd", "sighting--d53fe2fa-604e-4d26-9b91-27a89e1fd4e2", "sighting--ad4e8965-9523-4ef9-888f-58fcc284ffe4", "sighting--1d79bc9f-35b7-4d91-816e-29b10f7c4fce", "sighting--68e5e2fa-2810-4202-bc29-df22acf0df07", "sighting--4ee64ab2-0e53-4918-92e4-1f1deb168021", "sighting--fa6004d6-43bf-4769-985a-7d3b31879139", "sighting--b81afd60-1bd3-45f9-9ef0-047af37b6414", "sighting--b1ce9fc1-9f78-4748-b55a-b3b208bfd7aa", "sighting--55d2f35a-f8d8-40a9-b218-3ee0268ee458", "sighting--fc001ec7-fee9-469b-846e-ab0dac801156", "sighting--19c9f4c8-3822-47ea-8e12-645d01d7f77c", "sighting--cf0916ee-51c9-4ce2-9441-89fcac0c043c", "sighting--759ccd97-ffed-4456-ab1d-e49b0516c514", "sighting--e045a82e-8db3-4f9b-b263-2fe79964a7eb", "sighting--52549833-11dc-4d06-bf07-1804845d3595", "sighting--35719327-0d97-4408-874f-9385570fdc09", "sighting--2a6e9f46-e50d-4ec6-936f-ce536af9e100", "sighting--3b5016b1-ac0c-47a0-93c6-50e5882cb8b3", "sighting--91e9dce0-e8dd-45c3-85ef-70ed859c1436", "sighting--f05127c6-7903-4018-b373-daaa4e35bd60", "sighting--9537edf2-158b-41d4-8048-f28801636b1c", "sighting--64a6c524-637e-4738-83a3-8ae81039dba2", "sighting--52e65222-fbef-4075-8c94-854da39c6ce3", "sighting--e1ce21da-bbcb-4b53-940b-a985f575b79f", "sighting--6fd37854-223c-461d-a1df-a6ec4c337a2d", "sighting--d5c3cacb-5c2f-4a10-802a-9b32a479b664", "sighting--67f9310d-3298-4a2f-845d-1543131513b3", "sighting--c01323a7-7d89-4d47-b788-f5c11cca8ea8", "sighting--4ee8e09f-70db-49a2-a20b-72b8655e8aea", "sighting--72e2cb37-ddb4-4d82-9b0a-3481648a394b", "sighting--34241214-f647-4340-9fbb-e2ff39e58a37", "sighting--c2acea9d-3531-4c14-aa58-62d9335be727", "sighting--a87d7f81-f331-463b-9e0e-d0a8d558fe77", "sighting--82f861c8-40b2-41c2-a1c6-160894ad1683", "sighting--943df859-8cad-4fa3-9f85-2d9406b553b3", "sighting--d7467c88-ead4-4587-abe3-d4aa99aaa9df", "sighting--030a1b72-f616-4033-9243-d42babb5b8d2", "sighting--a34e8a6c-b04b-4e52-a55c-c135345cdc0c", "sighting--f38aeccd-e422-4065-b114-bfe61987d83e", "sighting--f047d30a-adf2-4018-b97d-900d91e07c2c", "sighting--e043249c-dd52-4feb-950b-931e8b2bc239", "sighting--8f0129a5-47d6-4925-bf74-b3bd908c13ef", "sighting--fdb10754-d814-4995-b4dc-dc60e35ad814", "sighting--c5dd45ba-067e-4193-9e68-81db360bdd40", "sighting--401ebd04-3a39-4d15-979a-787a70ed7a29", "sighting--28c94dc7-5432-45a0-84f9-e90241475da0", "sighting--4b8e386e-d376-4dd5-bc88-977a1c1de56f", "sighting--76b10524-df6a-4761-b34e-6c52b7822abc", "sighting--6b8a2a07-9994-4978-834d-31dcb93b0c3d", "sighting--e312d287-de9c-492b-967d-10606ada5345", "sighting--f68f0221-163d-4637-95be-1b37946ff77d", "sighting--6362b024-a777-4144-8b9e-50054cb11d44", "sighting--8fe106f8-414d-4e6f-a014-af578d816bab", "sighting--0b6acb72-c6b2-4e0b-827c-96c4c0df17c6", "sighting--4fe8afb0-a5ac-4b2f-af84-ccca53f56e0c", "sighting--2879c66e-7ade-4235-bfef-2a3d14dcf5b7", "sighting--0e6c1e47-c848-4e06-aaa9-1621b6b7e109", "sighting--1bff1485-eb44-4707-af7a-a81a1783142a", "sighting--0137daf0-1b91-4b2e-8e69-3761e2c82b56", "sighting--c0371bfc-282f-4754-a1fa-acb4e636853a", "sighting--094d0420-f9aa-4ded-860a-4f3e6d0f56e8", "sighting--9f75c29b-788d-4228-9c99-8d57d1abea80", "sighting--ada7bd62-1fb9-4e92-8766-4ad915519800", "sighting--1cf3078a-8096-43bb-bc51-4fbda63c99d2", "sighting--a6a7a9af-8327-4958-ac07-c8fc125be9fa", "sighting--5b39b409-6ffa-4396-bce1-c322dab5166e", "sighting--725290e2-ea4c-4c2a-959a-bc92cb6947ff", "sighting--0a246ee9-7726-4600-bb6f-ac855184dcbd", "sighting--41e0467b-fa19-4c5b-a831-cf45f6fe236a", "sighting--051546c7-b26e-4c92-9c4f-ebc6f8cc4687", "sighting--804cf50b-3f16-48b4-ba59-da0fede9b160", "sighting--e3f8c254-2f8d-47f3-88bc-e3962cd5cfff", "sighting--13d00bf0-f272-4891-b57e-778f7a2c303d", "sighting--935a2f58-fce2-46aa-af43-0b1a1043ed0e", "sighting--170d497a-1d13-4ce8-9788-a9a635a80b75", "sighting--53e59de3-ae2c-498c-a757-f3dabd708a6b", "sighting--e0f701e5-50b2-4264-9912-ec37c4367ebe", "sighting--0701894b-573e-420c-b395-331e65b53eba", "sighting--195334bf-c05a-469c-aaca-e5b436a6b4ef", "sighting--053ecf77-a615-441e-b794-6c7ca92d777c", "sighting--c6c3f517-8ad0-4b14-bf01-ea2ab16d1d7f", "sighting--66038552-3a7f-48b2-9bd3-6ca2c7b77fac", "sighting--49cf385d-3909-4208-86f5-ce6d1b0c7a06", "sighting--24ceec84-9782-4355-a9a4-3feb638fb82f", "sighting--a76f8797-570a-42cc-82c5-b73bc2f96d6e", "sighting--b281e0ab-ce67-437b-b93f-be681b386188", "sighting--7bcd1f2d-4515-494c-a16a-aeb82998f2f8", "sighting--0191afe9-fd95-49c4-aa83-e4e070bf0405", "sighting--10033b4f-b447-46be-b776-2a693de26d93", "sighting--00e8ad84-4a28-400e-b32e-802aca61472e", "sighting--7790bbd4-34fa-443f-bf0a-ede0efa94882", "sighting--da557406-c356-4a11-850b-5e38e42b7cb0", "sighting--06c99acc-7565-4f97-ac57-bcb19c7771eb", "sighting--27820c5f-2d6c-422b-8a12-1a36ffd07427", "sighting--be06d484-dfb1-478d-a050-41529efdcd26", "sighting--e0b1e79e-871b-43db-9c3d-1c2b0ff354e9", "sighting--a542cf5c-50cd-42ef-8b91-423920f7eab7", "sighting--cd71fe47-ef95-4635-b63d-2d2c5d6840a4", "sighting--9a55c8b1-5b37-4871-88ca-254fd5c3afb6", "sighting--c119815a-c0bc-4177-8ab9-f7863e65feba", "sighting--dd6ef9ee-556c-47b6-af5f-5d06f5b23f95", "sighting--432953c7-ca9b-4756-b49a-51621ed40b53", "sighting--2032df77-9ee8-4f52-bb2e-f4b59adbba51", "sighting--4b567bf8-61ef-4695-885d-7c3cbe71acec", "sighting--82a246d8-0868-42a8-aa53-193fd3ef7e03", "sighting--e0d420e1-14da-4168-9af9-f82c34209067", "sighting--522953f0-4953-43fd-9d4d-8230cd4a90ad", "sighting--eb3b9cfa-43aa-468f-80f7-e8a50669fa65", "sighting--d7b8a9ed-b88f-4357-b9cf-0a376a7ef302", "sighting--ffc8f736-f109-4569-8195-945a97663fcb", "sighting--f3484e54-5de0-4845-af7d-fb5560f571a4", "sighting--d50e8a4e-b6f6-4448-be87-e1b659e6c2b9", "sighting--f45ae60b-7bcf-4424-8365-f1c1f704b685", "sighting--9a491e8f-2ab0-4ca8-8ec0-7ed32aa89895", "sighting--bd13e9cc-210d-40aa-9f4c-6e85ea594009", "sighting--23539366-3616-4c1f-8569-51779d80dcbc", "sighting--7e6439eb-40f1-4133-b84a-bea49752c3da", "sighting--88f244da-03a9-45b6-8518-4772c2cbbb13", "sighting--d4028409-2191-402c-a3ed-5fd44045e5b8", "sighting--1a8f9d19-8a53-456b-96a9-770692f738ee", "sighting--a59abfb9-2998-4841-bbba-72580c15733a", "sighting--8f801338-8766-47c0-be80-9ec7f6da82ee", "sighting--c1e6b1fe-6480-4c91-8eab-95a2c7556b77", "sighting--9a2e33f8-e03e-4f74-abd8-e7003dfd41e9", "sighting--d922a2ef-cd73-4933-8765-f84a3e1c0da7", "sighting--647cbf51-bc1b-454e-9933-703fbac868bc", "sighting--737e2421-8c02-41bb-9986-3933130b01f2", "sighting--3987189a-3ee0-475b-8f50-3bd91c4f6429", "sighting--7a580dab-4e38-4af4-bea9-59c2d467200d", "sighting--cf7f94b1-19aa-45bc-9048-c65e9b68a3c1", "sighting--2d471d8c-7aeb-471a-9534-ea63777dcb7e", "sighting--a2222c03-c961-4849-a530-4a6e0af63347", "sighting--bc7737c6-e88f-4e38-ace1-f4f120b17b71", "sighting--72fcfc3b-0bd8-4ee2-a055-94b1ada65e14", "sighting--ae4bb8de-69d5-4b1a-85fb-00adce240ceb", "sighting--efd0494d-d766-4da8-a2a8-3c6af8ec9d56", "sighting--fdee3d82-128c-4364-b264-4f326b32f6ed", "sighting--27bfe62f-d7f8-4c09-9052-c45e3eac43db", "sighting--e3eed805-ca72-4b56-a302-eb83bf08bbc7", "sighting--dc531bbf-c71d-4d29-a211-988e78eb758f", "sighting--9f0d44de-4cdb-4ebb-9b62-2b5aba81a2da", "sighting--3745d923-b613-42c5-ad3e-990ed066a549", "sighting--1a75c724-8886-4416-8df8-130c6f7c5130", "sighting--cc123aa9-f663-41f3-83dd-cc924f226095", "sighting--2be26850-4922-4b3a-9b1f-366e707b4c72", "sighting--0f93cf37-1bf1-4cdb-b1b0-4ae836fee243", "sighting--e8131eae-daf2-4e77-9138-d75382c8f843", "sighting--b01f0dd3-5ba0-4e83-87b3-5e97e09c37f8", "sighting--df5964eb-eb34-453c-ae89-b03f39e0c142", "sighting--c1b8334c-faa3-46f3-9017-b2083f4a381d", "sighting--fb264937-be89-4773-86d2-800734ba5720", "sighting--adf54ac5-0ec1-40b2-b1eb-a4401b7cbd63", "sighting--b2092792-ce96-4a3b-aae8-63995b8f3896", "sighting--f3b44b97-aa5a-476a-9a56-e6af394391b9", "sighting--adeb29d5-5701-4d88-9ba8-fe130f7f4361", "sighting--9f7f8d7b-e603-4771-a23b-e4e36d186d2e", "sighting--ccce9c9a-a4f9-4140-a1b7-cf02369c644d", "sighting--546afef9-f9f9-4a63-9e53-7384163b75f2", "sighting--b998cddc-73b7-4a58-a3bf-da53f930157c", "sighting--4969c2e6-3446-4b77-ab0b-7bd66e075afe", "sighting--29e82de3-bf23-44d1-b638-12d2c2e25e99", "sighting--e62f2454-8fb2-43ed-bc82-b6d28ac8f900", "sighting--7bb546d9-1e24-4ab3-b942-7f715daad0a5", "sighting--dfb54708-ea05-4a42-a8a7-78eeaa3ed131", "sighting--ca93b67c-aaab-424d-8378-006655d83a53", "sighting--64752391-b9d9-49fc-a9e2-310d8c76cbe0", "sighting--ce9d662b-5884-495b-a210-c6f90043ade2", "sighting--84cb152e-d08b-42f0-9df7-4ccba7651c46", "sighting--f6fb835c-4dbc-473c-9485-4769e329ee05", "sighting--76dabff4-d4cd-417e-88f4-a816c0dc1fe3", "sighting--ca5b1118-0b97-47e2-860c-52c63f24e704", "sighting--6072536d-3587-4efd-bf45-76e1f0472e1d", "sighting--d6e114a5-99f5-4c7d-8c4f-dd7a7904a506", "sighting--4df33dbc-368f-4b84-81bf-5660430dd6fc", "sighting--11ee9c9b-2b54-45e2-8ef9-4d2dfa891eb8", "sighting--39dd4cfd-c4ac-4224-aa0a-ada92e11f7a7", "sighting--355180bb-1909-42c2-8cd5-d880269aad35", "sighting--563e44cf-fc17-436b-a97a-30a62f97be12", "sighting--a7e30285-b65b-4fac-b8cf-54b65e8c4d1b", "sighting--1a72556e-a804-4a54-b32e-9ea459abf84b", "sighting--24bd42a6-19cc-43fb-85a8-ca4cea6b1dbd", "sighting--0f946555-06ba-4f79-b452-4d370782531c", "sighting--56b79e99-2c44-477a-a09b-b8580246ae3b", "sighting--ba6766d8-52be-4b6c-95bd-290a8c87222d", "sighting--2f93b60f-d919-42e8-973f-5219fe029aff", "sighting--02c10888-8543-42d4-962e-79747357b2be", "sighting--f2adad62-41ca-4cca-9e41-72f51e38a990", "sighting--94bdb94d-2e8d-40ba-8244-95044eff841a", "sighting--8a74bdfd-828b-4165-bf31-a584f348da1c", "sighting--18bad9e9-d19a-486c-9b9b-ff620e84c1e9", "sighting--67aefd1e-3c7d-44ed-b3ce-6350c56306bb", "sighting--7d9441cf-735a-47f1-a739-3803eb7f7e82", "sighting--1c5c0982-6678-433a-b60b-a4f3facf4d2f", "sighting--32e35de2-0c06-474d-92ba-aa608670aa96", "sighting--723892ce-4f8c-4f25-8c9a-0a9c911919bd", "sighting--01ccf7f0-2b5f-46c3-ad10-f8a22bab162f", "sighting--48119166-db60-44e8-a641-f5ad7fb6982c", "sighting--53633632-7eab-47ce-8ce1-1c80a2d47f72", "sighting--1e97719b-0d74-4f1d-891f-19cd9196268e", "sighting--f55f42ae-5469-4d43-b8ff-dd9a32aff615", "sighting--db8f6e00-90ba-404b-bbee-f75855ed06e3", "sighting--208c8793-5e34-417a-8760-34c08c106b6f", "sighting--71199481-bc1b-41a3-a3e3-ffe68f3af820", "sighting--a9dc9cee-5574-4929-be38-e24ca659aebe", "sighting--4a37ff86-1ba9-4461-b6f7-67ad0cd0b633", "sighting--8d428527-6d63-49c5-aee0-667c01856fc6", "sighting--34eeb7ba-e944-4eee-89de-26a3a72a2df1", "sighting--7d291e23-46ba-4e51-823d-42f0582a3229", "sighting--2b013da4-64f6-45df-b768-bff570431949", "sighting--14519261-c4ad-464c-b5dc-a339a4d77a46", "sighting--e28a1eba-9f89-470a-ace4-393ff45a39db", "sighting--da1b2577-29e9-40b6-88fd-b92d28fcbf82", "sighting--3e27f11c-124a-4496-a08e-1f134e25e994", "sighting--d4b5ba9d-3df4-4c38-80e8-4db255951d7c", "sighting--c363cf47-18a2-43d6-bfa8-eec1a5039f29", "sighting--3f805a67-0a5d-468a-bccc-7059c540cf04", "sighting--006b2736-7071-49eb-8af6-d99a4b394d1f", "sighting--6c139f98-bc5f-46f0-805f-47afc8d8dc0a", "sighting--4371c1c5-70ec-4493-988f-ec5c430214f0", "sighting--1761c977-b571-4bcc-a0b1-c20eb6fbe2fe", "sighting--0ca87dfc-32b7-4c6a-82f6-da62b3f17f87", "sighting--64faa6e8-d173-4206-9daf-fd28432c00e2", "sighting--0524e9f7-d553-46b6-ab9f-6dc5f810ee01", "sighting--b831cdd6-72ac-44c6-b03f-33d2e555ba09", "sighting--7858df65-923c-41db-87ee-18382adc91a0", "sighting--860e255d-c723-47f2-8964-82613acfd5cc", "sighting--4eda6c67-24fc-4389-9945-b21371f91004", "sighting--8824528e-8948-4841-93ae-3b037ce7c1d5", "sighting--7ea95bbb-0441-4493-a9be-3572c048d02d", "sighting--fe5cbbcb-e085-4b57-80b9-424264a28db0", "sighting--83be96c1-9b94-4d60-822b-42da96397529", "sighting--47585963-eada-4ffa-ae20-4218f4e95a03", "sighting--5a417ea8-2564-4b4a-a490-a183aa499542", "sighting--c57e9760-629b-4cdb-a52c-f153f8f1796c", "sighting--4a9f7410-b634-48d6-8ae5-edb06dd04bea", "sighting--393c8d25-1c43-4538-b28b-af870aec8789", "sighting--9fcb3c33-c22f-4630-855a-b0346c68a1b9", "sighting--e8538951-e3a3-4bbf-83ca-47cb36aca7b5", "sighting--7adbbc5d-1761-4f57-bb51-58b9741a1fc8", "sighting--bce390af-39b3-43d6-8e42-f7858c98a8e1", "sighting--2172fe65-f70f-4e15-a919-c5a3343583af", "sighting--a08a9634-cab9-43e2-a9ec-e94da483544e", "sighting--16c12575-2d6d-49a1-ba1f-ba8589ce22af", "sighting--4ac479f8-ea34-46e5-9ab1-84afe53b651b", "sighting--822d3f50-902e-4e31-8d86-83e42e1bbab8", "sighting--657f6feb-5c68-4360-8303-e53ed1a90627", "sighting--2d6b6824-77fb-4c75-8510-92b5fc838bcf", "sighting--c59083cf-bd49-4405-8148-7b8c5b6e7b18", "sighting--a781c85a-68e4-491d-b521-71b936d917f6", "sighting--621c07f3-5293-49b0-8daf-f03e5937894e", "sighting--32279cfd-25f1-43d9-b5df-dca97e3b3a37", "sighting--83d52081-3b95-45bf-bdc7-74ddd0bcda56", "sighting--a76e5bed-4699-4316-bd9b-f81236965787", "sighting--a9b3967e-ba50-420e-9299-b859246761dc", "sighting--9a0a1773-16b1-4fff-ae18-ef2965544d1c", "sighting--fb164fbd-2fa5-4cac-b575-679512ba695f", "sighting--ded91611-7a51-4ce5-936f-20757802d302", "sighting--df09dbb5-0875-4ec7-8c86-391971966b5d", "sighting--66faa466-a5e5-47d7-80bf-2f5721229915", "sighting--225b58c8-1bff-4c72-8305-fcb08413d796", "sighting--0d47e250-0bd1-420c-ae5e-8e894bcf1f3b", "sighting--b5fe3fd6-ef93-43a5-b6dc-d88c07b4af6a", "sighting--26f856eb-c360-4688-9ae0-611a2ff9ac6f", "sighting--33323cc8-494e-4124-99e4-ebbebc33ac9c", "sighting--ff6f732c-55ae-4677-ac30-8371fd9bf855", "sighting--5752433a-f3eb-4b54-b44d-f62a806bf4cc", "sighting--6f5b820e-a118-4f20-bc16-a9b62524b182", "sighting--88e56209-b93d-44fc-99c6-dd9678adb84c", "sighting--142d98f3-5928-4505-ae72-6d4228477a58", "sighting--c7ba6b13-945a-446f-a108-37114f951aa8", "sighting--0aaa948d-420f-48c4-92d8-512e9064675f", "sighting--cc15235f-8786-4864-ae70-7453df2e711a", "sighting--3964efaa-f2dd-4611-9610-d1d3053f6e67", "sighting--ec788ace-8b68-4322-8a97-8d126b901755", "sighting--5f7c618b-8b17-4751-ae66-631ddb5bc37d", "sighting--207b6d1e-d58b-427a-964b-3d6ab4f6ceaf", "sighting--f5657d09-9ac7-4954-8fba-4e666d70363f", "sighting--b234f0a4-b877-4156-bfe6-3b6c03dd2db2", "sighting--f9704bbc-670c-43c7-917b-a3a58bcfda7d", "sighting--3e5690c9-110d-4cbc-b1bf-f0c808bbdb10", "sighting--923539cd-ced0-4165-ad13-f38bab5d9746", "sighting--56b7bc18-0556-4798-8a1a-8daaf63e19c1", "sighting--e3d12c69-211f-414f-9454-f1ff9b658bdd", "sighting--5d1b6ea9-1e9d-4c41-93fc-0ede3c3d0b92", "sighting--4d943596-c147-4974-8ef9-2574c38ddbb8", "sighting--291c1c88-245d-4bfe-91b9-2345927a23f2", "sighting--2dc6c6c0-172d-4f17-9ee4-3c59acbfdcf7", "sighting--4be61b65-af3e-4d92-b407-1077db1d5185", "sighting--a0c752ee-9c50-4127-a20f-c31132da5dff", "sighting--c81623b4-0a7f-4680-833f-83d9fc900849", "sighting--3642f53f-73d3-4f92-844b-8237bd36d22d", "sighting--dd394c03-f921-4f34-984d-735d9b49b89b", "sighting--6b6e2af7-3929-4d46-8d8b-b0d06bea4dbf", "sighting--2e598345-922e-44c6-9558-94bf827776cc", "sighting--04ce7011-62a0-46b0-ad3b-98133300938a", "sighting--881b62ad-63a5-4154-96db-d457229ca02f", "sighting--27f0d4f7-efee-4688-b434-3e58db44fcbe", "sighting--8a626840-f820-4669-ad14-f67beb52ebfe", "sighting--52f3f809-603b-41b7-8750-74feb06efe11", "sighting--8d6ea816-6a49-4e5e-85c2-3db9e1f51347", "sighting--d44a1f9d-8dc5-4f21-bf4f-c88c41e99655", "sighting--117e9dd5-c06f-4e86-8b6d-8528e7dabc1c", "sighting--400eae5e-3da1-4360-be9c-606e562a57f3", "sighting--acf5966d-40f1-4c43-b772-ac458e12c5b9", "sighting--cbe2a10e-3ebe-49a3-8c17-7a184ea5e61c", "sighting--ce32ebba-7d4b-4b3e-853b-b45b34cde69e", "sighting--42c86812-40ab-481f-85b4-22ee412e69e4", "sighting--2c968ea7-db23-4081-8305-0a1ee7cb95bb", "sighting--d6607ac7-22ca-4a4c-9a71-993ae8f72980", "sighting--97c7dab4-be62-49dc-bf01-9ff483ec2ed5", "sighting--d02f7a3a-1331-4a1c-8bbd-557fc85f41ef", "sighting--4b2cba03-c8ea-46d9-8208-2969f6b2946c", "sighting--74198fdd-c7d8-4cbb-b89d-efa63c0c25c0", "sighting--8d29fb93-260b-4de0-a241-80a593f74e9c", "sighting--e7866164-6aef-4c06-a037-fb204067f847", "sighting--688f1d2c-9d44-470d-90c7-7deb1c1553fd", "sighting--13de5416-2d1b-4c2c-ab28-13cfb1f68eb2", "sighting--12bfce1d-57c4-4fd9-adfd-22c7b5f6fe2a", "sighting--a4485129-e508-4993-ba52-aee9802b6a6e", "sighting--4e584d40-bcac-4c25-9979-62aabd3ce1b2", "sighting--7871268d-bee2-42b2-b449-1e1f7aa939d3", "sighting--ae7dd0b3-57b0-480e-a514-692f5c341f63", "sighting--a3920281-fa2c-4e96-bf6f-6a2063fec5f1", "sighting--c413f247-e901-4eb9-8db2-fe52aec17fbe", "sighting--bb942902-3b19-46f8-a9af-9d6739772532", "sighting--ebc66c52-53dd-4349-826a-be03aae591a8", "sighting--1dd62e45-6020-4b81-841b-4d4ea5a404d4", "sighting--dc308be0-0aa6-4f1f-8511-f86e04dfe28a", "sighting--b262cdca-6081-4ecc-a74d-76f7796e1315", "sighting--a948ae5b-29d9-48da-8d7e-d26674cfc4bf", "sighting--3e3feca7-a226-416d-872a-cdf924d2fbc5", "sighting--6f11fab8-444f-42ae-8861-d9df9e2720d2", "sighting--ba53a009-e5f3-40b7-b797-218817dbf523", "sighting--ef69b253-e14f-469c-ae99-0803447431bb", "sighting--ce882d97-2315-4ae4-ada6-a9eceb3d4896", "sighting--3c50b60d-74de-448c-a2ce-c5b2a982230b", "sighting--3d06e97b-cbf9-4573-814e-04a381bdb3e2", "sighting--54d3d2d6-37d8-4437-a444-4eba8722b518", "sighting--9b8b650e-0d71-48cf-b24d-6c237dd63922", "sighting--37b9b8ed-2bdd-4e10-9a99-a54a10cac273", "sighting--d6a08092-4b6c-4b72-aad7-e7f49b6e0fc6", "sighting--ce2a5398-f4d7-4a51-9996-c094ef93c69e", "sighting--f3421eb6-8619-4606-9684-75fb0f47920e", "sighting--f058d8c4-3317-475d-b18c-448e6f0a0852", "sighting--22457832-749c-4611-a20a-f537c43bd757", "sighting--aca6e9bf-f331-45e6-a8be-d6f09faddb4c", "sighting--7cd9eb84-f47a-4558-a153-28df9a66c4af", "sighting--573bef58-ff64-4b7c-b793-fd09ca407193", "sighting--9ac29fd7-5ba0-4e06-b6dd-e60456dcb482", "sighting--85162c86-d9bf-45da-99f4-cdcdae927e5f", "sighting--973f13cb-7ff8-4872-bee6-dd26171ea1d0", "sighting--df7f8ddd-e91e-4f96-a189-8579f571b586", "sighting--88804a74-c0f2-41e9-beb6-eacf63b5714c", "sighting--5ea68662-3bc1-4a65-aff5-bc3f44c0e2d1", "sighting--d47988d5-4d1a-479a-b664-04f044ac1bcb", "sighting--5119498f-97cd-4063-9256-ca73717ea259", "sighting--c87c0aa5-d29c-4fbf-a427-2a73dc769957", "sighting--0b4ad1e7-13a5-4ce4-afbb-600fcd643498", "sighting--69bf9f36-48f0-4297-8430-f55909dd8552", "sighting--06c96124-b4b8-4093-97dc-da2c3a1f2c61", "sighting--e80ba570-1714-4867-97ea-0932f103fedc", "sighting--2c438200-2617-4164-ad34-ddcbe8f6785f", "sighting--cd68950a-60a1-4743-b149-0cdcc53d3828", "sighting--e2002061-f905-4cb6-b977-55b1d8e0f61f", "sighting--2946eff7-c555-414d-8ecd-d7329575b434", "sighting--cd2e2bca-c198-421f-bfdc-8877f5c6c2e8", "sighting--7efd983a-14d6-41d5-a8b6-c9111fa18de6", "sighting--f755bad2-5d9a-4951-a669-aa2682b7d1f8", "sighting--2d350666-76b3-4823-babd-eafe8d43ebef", "sighting--a36ba98f-2605-424e-b24e-71ac8c2625d6", "sighting--d655bfcd-807c-48c8-b648-97e368153ca4", "sighting--ba48e639-ac02-49ed-90a2-678a3254ac89", "sighting--4525673f-e1f0-4c7e-947b-7ca60a3565c1", "sighting--58a364bc-1cc0-4bcd-955e-5dc82308f6ce", "sighting--751c2f4a-f5af-41ad-8cd3-7d52e5140134", "sighting--a1e5982c-ed01-4182-b23a-f3f191f86aff", "sighting--640e7a92-25da-44cb-a149-05a899c1d5e9", "sighting--c2dc7a57-f23e-4974-9a02-2246f7a05f82", "sighting--38594f9e-04a7-493a-a2b3-22deb180d079", "sighting--f4a9e7d6-3d5d-44ed-8dc4-46de43d65e05", "sighting--3c9a931b-268f-488a-b1ab-f12cd18284db", "sighting--b0b56b3c-3213-4007-809f-819c1147d503", "sighting--2a51ddad-7d7c-4fe1-b71b-62ca347c393a", "sighting--6562baf5-441c-44fa-8f87-cd1f4cb33084", "sighting--ab4a06cb-46fb-47f2-b352-bc8a3e9c964a", "sighting--5e3d173f-d0bf-4e41-9512-6146a20850c8", "sighting--95f67c17-43eb-4e6f-8296-b4f8a3a7a1ff", "sighting--d0d31b59-c793-41f5-82ed-1ddcbe6718b0", "sighting--b519f1f1-07b1-4784-bcd2-99f7bf62fb79", "sighting--660a4a84-d929-4025-bc17-9b1c15289753", "sighting--575ec31d-39e1-4a63-a714-c67bf9b14467", "sighting--6d71ad50-9e73-424c-aff6-b6f2554aa484", "sighting--b29e78be-7ab9-4ae4-ab54-a7ef37c5645c", "sighting--c4935585-20ad-48cc-9643-e645f1baf0dc", "sighting--40f3660f-37c7-4ccc-90f1-3436757da8bf", "sighting--a98258bd-c6bf-48e6-aa09-330d7aad5b5b", "sighting--e41c58d0-9282-43a4-a14a-15ae5305f235", "sighting--773ed755-3751-49a3-93fe-0639269fcd20", "sighting--cde7fb70-c569-4388-8fe3-38ac11a24015", "sighting--1c67a66a-a3ee-4f4e-84c5-03489c1344aa", "sighting--428cba7b-6e35-4dc7-a71d-f2356898a73a", "sighting--f1def716-6cc4-460a-86a1-ea1d44a78ce2", "sighting--60692ba7-3fff-4d73-80cf-8a9408e43186", "sighting--3358d121-8fa8-4cbd-bf6e-24336c68109b", "sighting--dc8e32e2-1a3b-49ca-aea5-43045bdf1a1f", "sighting--94a361db-cd95-437e-a269-d398b9939dfe", "sighting--f54d9eba-574c-4182-876c-7c13c54ee9a1", "sighting--5ce21015-a537-4418-a4ba-3ac5fe04972e", "sighting--2005c260-7364-4af7-9620-7797092314db", "sighting--8d88d743-26b1-4d67-82bf-e55d1ded9871", "sighting--43b98e06-7210-42da-b1e4-ca733e8408aa", "sighting--dfc67d8a-4f53-44cb-a6e9-c7d5e767416b", "sighting--0175ce74-5321-43b9-87f2-bce17eb739aa", "sighting--813e0c6a-7799-49a5-8e45-bedbd7f62ff7", "sighting--5142b097-4ca8-42b5-a329-6524c87f5551", "sighting--da7d3684-d8f5-4a3c-aace-c7b11050d91d", "sighting--6af32bea-2f6e-435e-ba8f-be53774ee24e", "sighting--2d1f96ac-e4bf-4ca7-9ce6-b5f06cbfbd20", "sighting--dcc3fc1b-702b-46c6-975e-505ec9a86fde", "sighting--ed671ab7-4ee7-45c6-959e-cb5fe8e46543", "sighting--2928f2b0-b5ed-4631-8346-9bda6f53dedb", "sighting--5f574c24-4901-4835-882f-bf7061d945a7", "sighting--7fb13b29-c15c-4c5f-8871-3e9eac68047c", "sighting--cb7f5e65-bf89-405f-973b-e6badf239e2c", "sighting--ebe8fb94-dd93-4c66-934d-ef336a8cc22d", "sighting--8031f790-59c2-4f3c-842a-5aa1d671aba1", "sighting--d83368dc-3f0b-4904-8975-9a3ab871064c", "sighting--d195401e-6fad-47c2-9ee8-569b1f1511bf", "sighting--4bb733d7-98b9-4c92-a97c-fd194d12c3c3", "sighting--446f5a37-107b-476f-8dc0-f1b02f4f5413", "sighting--bc6b4eb3-59d8-430a-ad78-a551bc212182", "sighting--cbfdcb74-3c31-4d70-9725-3ab5ed1836bf", "sighting--9d267165-4a5e-4a1b-989f-91043aa1b28e", "sighting--54b8bdda-29dd-42df-b610-1eba7c03dd09", "sighting--799561e1-76a4-4dc4-b72f-68ccb5d96f8b", "sighting--ba11e86f-d4db-408d-b350-0a6f4b7a0bb3", "sighting--b0d00b3f-7880-41b9-8fa3-23eab4c88804", "sighting--541a1e2d-0caa-4664-b4ac-51646cacdc40", "sighting--d1856e93-45c6-423b-a95d-839b814ecd3e", "sighting--fd13139b-bd28-49b9-8940-ac2fd116f369", "sighting--d06f8b13-1571-4032-90da-4b5d04540061", "sighting--4e4e8dce-974c-4322-8ba8-a9b93c81c910", "sighting--f6e00807-1d1a-446d-854b-1df2012727a4", "sighting--2a12f439-69d2-473c-bb62-a394c0bbb58b", "sighting--6c5e450a-bdc4-41fc-9e08-4f2fb387a584", "sighting--04a5e45e-e5ce-4438-9052-47d5ec57794d", "sighting--3bffe1a1-8f6a-4d3a-bbb5-b7e5d58bdccb", "sighting--5bd61d18-f5f7-414a-9387-a81f9467cd98", "sighting--291bd2e0-7193-4dc8-8d1f-ea86f500150b", "sighting--0901a0d6-72bd-4790-ae01-47ab9c5164e6", "sighting--620ef5d2-531d-4269-9f4e-eacb8f5c836c", "sighting--ef77460d-f92b-4ebe-aaf5-adab4e8b1a93", "sighting--c3327721-d08c-443c-819e-edc901cd581c", "sighting--3739065b-103a-4e30-8d89-36e23a1107d6", "sighting--9bdf8688-cb54-4650-afe1-b85928826d22", "sighting--9bc19518-e284-4d87-8e51-aff18822302f", "sighting--1e19e7c4-e3be-4083-ab4b-99299fc64475", "sighting--24e1e6e4-5c53-402d-a2f6-426e24caa6ed", "sighting--9adf9447-8886-46ea-addb-a45ad720926d", "sighting--d6ea7189-66ba-4e99-9f4f-969abe6ea7cd", "sighting--a752481f-00f4-4076-88ef-089846cd52d2", "sighting--6c44f537-00a8-439f-b2eb-33cb6d715aea", "sighting--b749e4ec-a86e-423d-a33b-0357ee4588ef", "sighting--ad65cfdf-4e75-472d-88da-e5273c083633", "sighting--d7c17092-d489-4fe7-9596-4cf71fff038e", "sighting--5856dd78-687b-4e03-a2e3-acc57e7de8e0", "sighting--e090dc63-551b-4544-887d-5f25d046a006", "sighting--62a2dea2-e885-40b9-bbcb-2733b5ef1041", "sighting--df81b966-5fb0-41c3-a861-27b1274faaf5", "sighting--c480212c-7a83-40b0-9575-eb20e6141a78", "sighting--e4e58065-b2a6-463c-bfc8-c047d12727fe", "sighting--feb60f06-3ed9-4487-a02f-4138f7973290", "sighting--67b7d048-d6b1-4918-a358-84bb03677196", "sighting--bcd11f52-2f39-40a7-aeee-31bfb64d2bbe", "sighting--4a3118d0-0d03-437e-83b4-ddd89eabf75c", "sighting--3dbe367a-5f60-4f22-ab39-42d2b0acc9a2", "sighting--7abd6718-b335-4e47-a94e-e0d4597d18a8", "sighting--2c705c5b-8a81-4378-b643-233a44fbfc8d", "sighting--af852f68-3be7-4d5c-8791-9dfefca6dc2f", "sighting--a99652cd-c395-4364-97fb-db85ab5ab05d", "sighting--8717e4f2-c130-4857-be24-11dc5e338d0c", "sighting--3b706262-8af4-4933-bfdd-6148ca792126", "sighting--debb1bce-4a3c-418b-b5f9-ef503d3ef95a", "sighting--92052f60-a7bf-4156-baf1-b1deabad10c2", "sighting--06128811-2290-4105-80c3-6c280fbb1fed", "sighting--6cad78bf-b426-45f2-afb0-7e22b110f3ed", "sighting--cd159d0b-52bf-470a-a2b7-b3b1811bae1e", "sighting--7947a97d-4253-4679-8075-cf1868cea748", "sighting--fb568b4d-4ff6-4147-b54c-b294ea02a847", "sighting--965c8b7c-b76b-4e4a-b481-5fa0424375d6", "sighting--fc4d4150-8ea3-4b40-98b6-15bdb685687d", "sighting--eaaff322-a4e3-4511-a279-3e0396d1ae57", "sighting--7fcf4fd7-1223-415e-8d41-601cc59687b6", "sighting--e9f3c06d-41c0-4645-a8f4-2307c295b952", "sighting--d656e508-1967-48fe-8973-e2697cda4059", "sighting--2411c1b4-5925-4322-8b67-aa6c1762e08a", "sighting--02f1feb4-05d7-460d-8d54-ee751bdc0177", "sighting--3682904e-bb34-4a9a-860e-1b8333d1052f", "sighting--527007c0-3ecc-44af-ba35-bef35ffe14d6", "sighting--dceb8a1b-3afc-4555-a5d6-d4407740a44a", "sighting--25b09e94-5f8d-46b8-823c-157c63146dcb", "sighting--1e4896c1-8844-4c1d-9221-6e2b92d54d8e", "sighting--22181999-e06c-4af2-be04-e480b3c7fb36", "sighting--bfef3c5d-ae35-41e2-abc1-1b0f622579fd", "sighting--5ea62946-b967-43cb-8413-90d75c73b0c0", "sighting--a2f90995-5005-4b16-956c-bae38fe705c1", "sighting--ce20fbfd-f04c-47c9-83f2-82fde09ea18f", "sighting--ed34514c-1a1f-406f-ab28-cd7e07d4f62a", "sighting--59fb203a-b9cb-4aaa-9795-56b344be2efc", "sighting--13df74d1-43c6-4944-afd8-679ec9307113", "sighting--a5a6d3ea-dcf5-4185-8d50-b54b23401d20", "sighting--e5edbc8f-6e67-4a70-bf2c-6d2d9c0b17d2", "sighting--cb44f5d7-3454-4d64-b26c-1a8cba0ee0c1", "sighting--1784cae0-9610-40c5-9146-864e7f9fcdf4", "sighting--e84d04b1-2bcf-4075-957c-29fc66724711", "sighting--3c35c2da-c1c8-4a0a-b04e-d0dd1f6efd39", "sighting--b6bfeb16-7257-4e5e-a011-ceccd6b7f3cb", "sighting--81c25c8a-bb68-4b33-829d-7b2f64c3c8f1", "sighting--aa2fb94e-100d-46ec-a0ee-70721cc62695", "sighting--abd867d5-628b-4d31-bc45-d6efca574efd", "sighting--6c39baa0-5792-40be-aac4-0e1877001860", "sighting--ec9824d7-61cc-46e4-a7aa-6789755266d6", "sighting--9160ee8c-65f7-4e50-bc99-85109c737683", "sighting--573ed5e5-65a6-49aa-9ee8-05db3b00b3e8", "sighting--b2bab977-46de-4730-af71-eea6784ce1f8", "sighting--e5ab4867-2913-4d94-9ba9-a3053e04727e", "sighting--e4b25815-8ee8-43e4-81b4-663ab0833ddf", "sighting--df03c743-e75e-4ac7-8f39-d33f607c7d84", "sighting--a3f36bad-70b6-40d6-a393-8ca5c4e06ee2", "sighting--43e296a3-91eb-483e-b7c9-e9b2f3bc83d0", "sighting--feeb9111-cc45-4ef5-9e86-6e49ebf98551", "sighting--71dc462b-0dd2-4ce3-9799-1c1dd7222671", "sighting--ebaee150-972b-4f9e-9cd5-6554e627e920", "sighting--e90bd52d-30b5-42ff-bc34-0c24c58f28a5", "sighting--dd3c7a82-5e97-4f1d-98ce-3769e5e1d5f3", "sighting--2afc65b0-724c-4a80-8046-aabaf378422c", "sighting--28450b6f-c562-4ccc-af75-00af6767693d", "sighting--7825a5e4-754f-428d-836c-2efe6ae427dd", "sighting--a26a515c-bba9-49cf-8f48-c46155daa008", "sighting--eb5e4280-d6c2-408d-be89-70a1a7f56434", "sighting--1379f638-752e-4e34-b72c-f670845f1efb", "sighting--b094a51e-2443-465b-bce4-3dea3a80a837", "sighting--05773ee1-9e89-4419-9bec-9e1af618580e", "sighting--007b1d24-8ef7-4e52-ac65-860b6b7d1fb9", "sighting--39fd6bec-3776-4be3-aa23-3f1e2288283d", "sighting--0abc5cc6-c9e6-43b7-addf-84299b7c27dc", "sighting--6f3b74c1-ae86-4dac-afdd-19e9ec35cb67", "sighting--0249dfc6-e82c-4d98-bd4a-1f0f38963ef3", "sighting--8b408e40-0f73-4a41-b13f-0f75c29b3cbb", "sighting--6bfe8bb8-1016-4cf7-a87c-f834d7f4898e", "sighting--f7730309-3dff-4f5a-8f36-46ec5a26fcce", "sighting--80eb6d8b-c3f9-4444-889a-cbbfd40f2bd0", "sighting--8e403271-c5db-4ade-82ed-2d91c7213d48", "sighting--30b5bff4-0a71-49f9-860e-94125108e172", "sighting--6393ee9e-b087-4dd6-a035-b1f3413b0764", "sighting--70a523ae-a49b-4a0b-803a-f1f11de2b22e", "sighting--80d032d5-e88e-41ee-8ac7-ace5a9715cf9", "sighting--74edc1a7-2e61-42e6-85ac-db89c9caa5af", "sighting--881d4a48-eca1-4451-9dd9-889cca3a460b", "sighting--713b720d-4f9b-4b01-9d32-52c8d3f12fee", "sighting--7e71b1cd-af56-45ff-b3f1-97417b409755", "sighting--ae6925f9-65a6-43b6-ab29-5c20e4d3d7c3", "sighting--f2fa9aa5-5c1e-40a1-a8d1-1d3b581eef77", "sighting--c9907c32-20d3-41a4-a09c-45f79742f99b", "sighting--f70075d3-ed44-4fca-bca3-b9000c7328d7", "sighting--5f52dbbb-46b9-4bb6-87d8-c3fd7036d1ce", "sighting--3ed3f687-ed38-4b98-b8c5-a36d530db4ea", "sighting--c69ee9f2-8dd0-409e-af0f-92cde248a764", "sighting--bed9a00b-60ca-4ea4-ade0-2f5d57d4fb49", "sighting--e3b0bb3e-def7-4e50-8f28-f47faa745903", "sighting--0e269675-452f-4b1b-ae77-640d0e401ac1", "sighting--a40bdc38-180f-4ba4-b5b9-9d736178c1dc", "sighting--4ebf0034-2567-46e0-9b1f-861aa0744df9", "sighting--3a739bb8-774c-4780-b2aa-01df50c167aa", "sighting--6feaa458-3ec9-44db-b336-b3e6029d38c4", "sighting--b9f76fa7-f737-4cc7-bcf4-c6f44921989f", "sighting--4d9d6f2c-dbc7-45ce-936e-34c9f7480dc8", "sighting--c2828382-df36-4c2c-8a5d-6d8bb9401344", "sighting--85f56fa8-2daa-449c-be8a-c6194c814b7f", "sighting--e5c801f2-70be-4456-bbd7-8757f4270032", "sighting--924d4a60-0336-4098-b5b5-8ce684ce1f90", "sighting--57d6d330-8087-4d7e-a5d1-0bda284bc66b", "sighting--ffa16d69-b7be-4e62-9800-ac49ba41be0a", "sighting--8ed451c1-27eb-44c1-9598-ee04d1af48c5", "sighting--199dd01a-7415-4763-8548-79ac9b224ae9", "sighting--c5103576-eba1-4d38-b8fb-3a6da07bdef7", "sighting--2f6b623a-4ae0-4f4b-ade1-f16341d2c7be", "sighting--18e64920-2cec-4ba1-8218-8d2903e3f5ac", "sighting--07df7277-3b35-4823-83b1-248f198fc669", "sighting--7dd34f56-fcfb-49d8-8070-b800b80644d8", "sighting--809a5a88-38af-490d-bc7e-933f911e46d8", "sighting--1efcb11a-9d1b-4bac-a7d4-a6bcaa930838", "sighting--c15fc588-6a80-471f-b453-dbe51be73c07", "sighting--913a3389-7463-4691-9a13-9089fdfa9693", "sighting--79afc1f8-3089-4831-a6ac-b4da355e0f8e", "sighting--ab8b5687-c2fa-4d8a-a1a7-adc3fb3dfe01", "sighting--2f1f4c5b-2bc0-4587-b2a2-c559f828ec5a", "sighting--9ae3bffb-0d95-4b4f-843a-cc3a515dbc34", "sighting--990e0a52-b96c-4d93-ae11-6a676a8e05cd", "sighting--64e2f580-8188-4cab-bea7-d9c8a3fd06c2", "sighting--9bbcb450-ab36-4b1b-8de3-b747c2004231", "sighting--aefcfd9d-6cb0-415d-9d1f-7739601db41b", "sighting--6840bcb2-5dfb-4afa-97f1-c40733ac1c71", "sighting--3d4e7b77-06da-4cbd-b97b-905e8766cfc7", "sighting--1208945b-ba80-475c-8f43-7c3d5d81589f", "sighting--92a2e621-7d81-4579-b513-0a86c41619e4", "sighting--c8402c4f-c94b-4ab4-b18b-e8d95fbb28fd", "sighting--1304e5a9-4f96-42bf-af5a-2f393abe15a6", "sighting--10e9b05c-ecb8-4bda-9014-56fa6b8c2cf2", "sighting--549ef937-91b3-4784-9a6f-114e93ec59cd", "sighting--659a6242-5153-4509-a926-5f895a759f2d", "sighting--f2eeb8f6-a844-437b-a702-1bd1be06115a", "sighting--294cd246-133c-485b-a9ee-a4bdb6fd1ba9", "sighting--75330ccc-de8a-4e4b-9972-9f10445ec864", "sighting--4f66bda4-218e-425e-a408-19ceae8c8e40", "sighting--f0e973a7-20ba-41fd-8a44-899fb0edfbc6", "sighting--b35c22bc-a887-4266-8765-adc796123271", "sighting--677ccc88-e581-4950-8b9b-f3aebe56da7e", "sighting--a0546156-280a-4f75-9b52-f04ef0c0e225", "sighting--8e662c4c-09a9-46c0-98c5-9d8e28dd0ebb", "sighting--131d7a3a-a2e0-49e5-9e2b-a4e6349221d3", "sighting--86b480b5-747b-4f26-a6a5-b858872037d8", "sighting--ca55f982-d0c9-4c71-b5e2-f3ebc3a01529", "sighting--6295710a-3c30-4a05-8f9e-2cb7df334c23", "sighting--b91ff25a-2fd5-4e96-9666-b03830bce6cd", "sighting--5ae68796-c9ff-47af-9d2d-7ef47585e71a", "sighting--645d88d9-184a-418d-b26b-f7e18ba924cb", "sighting--ee5edd9a-b49d-404d-b30d-40473050cfbc", "sighting--06f23360-911a-4dc2-bbd8-f5d723faa9db", "sighting--d7a908e3-1d22-4f51-b650-ec0570783d1d", "sighting--d5fca918-e03c-4070-906b-757db186357f", "sighting--05d28ce5-25c2-428d-8cb8-5e47a5726481", "sighting--896454da-a500-4282-8923-bd5e75a722fb", "sighting--aab1ca3a-49ce-4a1c-ba08-ecdb02699a18", "sighting--66877914-4f53-4b46-93fc-67c9b4a430c1", "sighting--ff050c1e-935b-40a3-a9fe-c8d1c2d8230c", "sighting--0cf7b68c-3320-47ae-ba72-d1bff88a9bca", "sighting--3fc9238b-3f2b-423d-9286-be19084f6c81", "sighting--44d1522b-162c-4029-96ee-ad3830ab98c2", "sighting--914eb25a-e590-42a9-86ca-344b2daaa0b5", "sighting--3ecac5f9-dd3d-434a-aecb-84fafb6ab322", "sighting--09a803d0-f6f2-4b48-9218-af88ef26e1e9", "sighting--babffef2-32f8-4958-8bf1-422f3ade8c5b", "sighting--b35f1faa-063e-4d23-b16b-8dc66bb8c39d", "sighting--236e7209-2726-49d2-9546-6d236d0e8904", "sighting--7ff97963-31ca-4e73-a6eb-0af760ce88d5", "sighting--77fdecd0-17c2-4961-8b54-ab0fe45913cc", "sighting--03dabf2f-9968-4753-b8be-3b293af81920", "sighting--a8dd9866-cdaf-487f-b789-4993043235c7", "sighting--f6e0a422-f2e2-4c6d-9c28-a7b248d0a0c1", "sighting--bfc792fc-d998-4562-aca1-301f7c8ee74f", "sighting--534fa3dc-b298-4a39-be2e-4804e6de50ce", "sighting--3173f2bd-21cd-4822-b52f-53d6bb054091", "sighting--afd807fe-9da2-41c6-8e55-41e24a2f43fa", "sighting--89692389-a2c8-4602-8cee-a4018a6065db", "sighting--4eda3ebd-553d-4a85-8a6a-a4bdc45751f8", "sighting--264b8ee4-de30-4b45-9d08-1dc3f8bb06fa", "sighting--83d0917f-d251-431d-a589-166e7f95e9e6", "sighting--84604a0b-ad0e-4031-9174-2949cb836708", "sighting--5c13e0af-2a0f-475b-b4da-cc79731abf62", "sighting--0d11b23d-614d-46f7-ba23-ca061115bcb4", "sighting--2ddb397b-4f8f-4b15-a55a-4634ff6e1ff3", "sighting--2920823a-caf8-4965-a297-f02a22438c3e", "sighting--5533eab7-1265-4f3c-9812-68b05a949499", "sighting--b290fa8e-8f21-4dbf-97e2-8c1a64728484", "sighting--8f2270ef-7269-4353-9bfd-6fd173cbd114", "sighting--185b5f01-c55c-4166-bd17-0f4b4855a9ec", "sighting--607dc4a9-f8b0-41c8-80d2-27b7073f4631", "sighting--54c73a60-d269-4c8d-8e0c-f1a7d3abe3d6", "sighting--e66f9cc3-8331-4061-9c39-5b3df783519e", "sighting--bb19dd61-f61b-4045-a3f9-86774119f2c2", "sighting--5e9478b1-55b2-4e17-b0ec-328a2644df27", "sighting--da1ecee7-a732-4121-ab76-3392d69535df", "sighting--890b07ba-0219-48dd-9992-72e2df192989", "sighting--deceaf99-46bb-4e73-adf4-ce7a11e844f9", "sighting--494d8204-5c21-4af5-abb6-d62806473e96", "sighting--4d9a44a4-c685-4383-9637-f97f223777f9", "sighting--8c042280-eaae-4400-9449-62e047e83b1c", "sighting--395748e4-bdaf-4e10-9d41-f0c9a7d0eb62", "sighting--51c24c6b-8599-4ae1-93a3-085c9f733292", "sighting--508fb851-6835-48de-ab69-26f80084e29c", "sighting--e3e586c8-738d-4e76-8967-b31e73d23b61", "sighting--bc64628a-851c-4b0e-8c1e-d1d028b43f76", "sighting--49fb95fd-4c44-4d57-9f64-f2d642da18b4", "sighting--d778b1ef-4910-4a29-a1dd-fbc25557f374", "sighting--55fafc8c-e84e-46de-ba8d-bbbd686b25e7", "sighting--5e50f6ab-ad1f-40e2-8ee2-3fa4365bf171", "sighting--0f587058-764d-45a5-bfcd-f9167d57f8ac", "sighting--6a41fda0-024a-4c13-98cf-8fc4f9b7c9cf", "sighting--3fb38fdd-0cc1-4e78-b8ed-07b4889b76aa", "sighting--1f636e37-05b9-4301-ae3f-88cddbb43289", "sighting--224a6497-e449-45f0-a8bf-dd9b5ede1185", "sighting--c5209fd4-46db-4061-957e-078f10c2001f", "sighting--88a2b1ef-6c51-477c-889b-aefaa4e10716", "sighting--d5e27125-1f42-4a28-bdad-f7ff63e09df0", "sighting--2e3bf353-b702-4ee2-90bd-347ef5574969", "sighting--268ed83f-495c-41d2-9672-d538ad575e77", "sighting--13a5d075-8157-4ad3-8936-668d1b05b4a7", "sighting--a76f6dfb-1916-4fa5-b2a0-abe042e5d445", "sighting--f45370cf-948c-4e63-bbcf-6cc876ee5ec0", "sighting--27fe0b0b-4470-4d3c-9433-a8cb67f9ce81", "sighting--06c50269-6828-40c3-85c1-bfbe6047f869", "sighting--dad559a8-5005-489d-990b-f3edcf7f43e3", "sighting--516b08c7-eb3a-496e-8551-5c6ad4bfd311", "sighting--538d91cb-5d98-476f-a0a2-eb926d34f2b1", "sighting--fa76d829-5001-4f56-856c-4a773b573713", "sighting--1e5ccfe8-ac89-4699-8004-6aea1868c96f", "sighting--f8bd1f3e-42f8-4a53-810d-ab1e77dabf5f", "sighting--7702756d-6e79-45be-805b-5e3107f8dc1d", "sighting--addcac70-e128-4f21-9bf7-31f42784fe5b", "sighting--599f7c85-e51a-41ab-bdb2-bbb8de5daab3", "sighting--de0400d4-b0fb-4eed-a0d9-39744c3a6403", "sighting--8f9ed981-2039-4a9d-830e-b7098a87ea56", "sighting--55b16814-88b5-4e78-bc55-01a57bb41243", "sighting--fce51272-72d8-43c3-a7cc-1143187a559b", "sighting--76101e06-d953-4044-aaa4-a774c566f90e", "sighting--754f6585-8130-4070-bd5e-4f65dad490f4", "sighting--0207c7a8-a9a1-4630-9709-52db3d6a4c36", "sighting--c7906aeb-d4fb-4e13-9f27-b611206f3c21", "sighting--4425c2d1-f07d-48ce-b511-ecae02a57e8a", "sighting--a21b05b8-b194-490a-8e25-721a94d2f672", "sighting--f0b7a901-2ef3-4cea-9540-b7d4ff0f4722", "sighting--45402323-2d13-4f9d-a496-5e124c2cb8b8", "sighting--5618e6c2-0df3-4ed9-814c-48c5b3ce942b", "sighting--1ba24e8e-22f0-43f9-b6b6-227272fa5d5d", "sighting--5fb0bfbd-3145-4c20-846e-35bb2ce412d3", "sighting--4a960001-24b4-4545-8008-2145792039e7", "sighting--e52a7592-0699-4d78-8bbf-fb4bba254552", "sighting--d4bf6a99-1686-4857-b36e-0c91895ab7e1", "sighting--b736727e-3613-4afe-9d5d-231fd6b3ab14", "sighting--e40ed538-e6df-4a02-be8b-d1193d7fec4f", "sighting--6dd9b226-7dc2-4a6b-a0b9-30864f7d0659", "sighting--0f07e2c5-3d96-408a-acdd-f0890f88b4b4", "sighting--656f5942-5dbe-4670-92bc-c79dd19fe741", "sighting--6821fe20-cd20-43fe-b6b1-02f10e2dd066", "sighting--9587a8eb-175d-4404-b0a3-bb53fffd40d7", "sighting--ebd5142c-ddae-4b2d-bea9-fef0d5dcb0bb", "sighting--8c225763-fe20-4396-a5d9-35d6477000fd", "sighting--f120e189-4a45-40e6-8052-263afd6f83ab", "sighting--ee7ec990-3a1c-4112-8a6a-c40dbfbb01d1", "sighting--62e1ee1d-b7dc-4434-bb4e-e3a22e96a54e", "sighting--7e418b7e-cf3f-4f2e-a4d7-f6ce2a09e480", "sighting--984d4be2-502f-4d5f-86a3-cd52e33f34d0", "sighting--4e7ea8da-dd1c-484c-afdd-cf121287a8c5", "sighting--74a139b5-f50a-46e1-a303-c88de0fe6786", "sighting--1cb425f1-d025-4bf1-a0ee-4ebb1958e4e7", "sighting--261f0ea0-e256-41ca-9712-263db35f63b8", "sighting--9cc4af05-a05c-4130-a4f7-782de0e2eb51", "sighting--ecc5b842-8855-476a-8640-856bcfdfa289", "sighting--aac12ad1-2b72-4f51-b5fe-4b64780e3511", "sighting--bd4e569a-618a-48ae-b32c-62aa99a96322", "sighting--1ccfae44-bc3b-4227-966b-fe18a8b84f5b", "sighting--2d7dfb57-7c5a-4929-85fb-0c7ab2e31780", "sighting--0682461c-8567-4f83-af0b-41312ba595e7", "sighting--0cb399b2-70d9-4e0f-b8b6-79f04965dcfd", "sighting--e0e53f12-b986-47e6-aa81-cfb2a147926d", "sighting--f9b6a806-34c8-4a36-b3c1-da42ecc7225c", "sighting--233da58b-89d1-4f2d-b7b8-dba2d3dac800", "sighting--06c70d45-4743-4598-9d47-096835446800", "sighting--3d63fdf1-dc6a-43b5-a9d2-e56ee5bc13a1", "sighting--20264f24-54b2-4638-9cf0-fdb4ba5b2447", "sighting--b9cf28e7-e8bc-4256-8f0f-5a917731a477", "sighting--fc8173d1-2e82-4bb4-aae5-f7c9929236ca", "sighting--f64ffd87-3adf-4a92-aae1-85e3bb85613d", "sighting--2edb5fd9-1fba-4fa7-aa3e-4438688768a2", "sighting--c36e9693-4c91-47b4-938a-c0c62d053b8c", "sighting--9bcc2948-1d4c-4436-967e-07795901c722", "sighting--6d4027af-39fd-46d1-b732-bd2a0a75b38b", "sighting--38aca04c-3819-4393-8624-eea5afc05b51", "sighting--45b07a77-ac57-449c-94dd-6498b0f20741", "sighting--ffed4d00-15f6-43de-a028-3a3a3cf3bb25", "sighting--52f21c7f-c665-43f3-8fab-65f456bd1206", "sighting--2f5e05fc-298b-431a-a8e3-9490ec6d331e", "sighting--f2de17ce-8dc3-4b5c-8b98-5fa6ffdd8cb8", "sighting--9d521f87-e21a-4467-b7a0-a21fa4e2307c", "sighting--fc13b440-373c-4867-b1e3-81e44a687833", "sighting--bd23296b-b2b8-4a94-b727-b7aa56ff14af", "sighting--506f5caa-f4cd-415c-ba47-14e071f3d3c5", "sighting--3fe27e4d-907e-4f98-a79a-337aa7e1bd9b", "sighting--d8a0c51f-462e-4a3d-9aee-96160a0c8c5c", "sighting--c6321c85-660e-46db-8be4-76ccb6408fe5", "sighting--e4a28081-da16-4059-99aa-f56a3d41f00a", "sighting--370df6c7-afad-4825-ba30-4c523d7ee641", "sighting--d660e0a8-5001-447d-b275-ce2620d9680c", "sighting--96f90d96-020c-4f8b-bf2b-0a93f3600a35", "sighting--c130addc-3207-4dfb-bad6-a4ec5a4ec9a9", "sighting--b14c53c7-2ce6-4989-af92-db32ede3eee6", "sighting--81e525c7-9aac-4127-8bd9-4d6746b35eb1", "sighting--9b963a9b-9dce-4c53-a046-1a56f6b014c6", "sighting--6833890a-2e27-465e-ab9a-cae730f76c25", "sighting--8080f336-76c1-4654-9b23-153252fe7ca9", "sighting--33669426-da53-42e1-badd-2fc7a4852502", "sighting--bf23634f-eb1c-49da-bce1-8f5225e2c465", "sighting--26a9778f-f6a0-4bdd-a730-49d8aab98d2c", "sighting--c128a77b-cbb4-4ffd-98af-7d63850a4f93", "sighting--0e5e394e-04cb-47f2-8e0d-4ab8dfe818c7", "sighting--aaa4b76b-b81a-43c1-b6f8-b6294a5d018e", "sighting--987f8c14-7aea-406c-a952-b8c15d9446b5", "sighting--1678ff9e-2525-4e4b-ae42-7ed57b44cea9", "sighting--75b8e790-e30d-4293-b208-81a7f4a8baa7", "sighting--f103e85e-7f6a-49a1-b32b-765851701c11", "sighting--f4d7052a-aaca-47e8-ace8-be5d40aaf89f", "sighting--f5c27308-49dc-4506-be4a-99392fbf30fe", "sighting--b941269b-f2ee-4b90-a7e9-e37095d16753", "sighting--1c8d2fdc-c212-45d0-8237-a1bf906e2bc4", "sighting--3d81d09f-8046-4358-bde4-8ad2ed4de538", "sighting--e55bd717-ab92-4e53-9652-68b6413b447d", "sighting--9e8f0c7a-8d56-4363-90a3-2b9992b299e0", "sighting--fd09525b-5c81-4729-aef5-18480b44747b", "sighting--40d1f80c-4fbc-46ad-9f02-7a7d4160b3e3", "sighting--d8654029-c78f-46b1-b8fc-9abc1bc19fb8", "sighting--8b253fdb-dc52-4787-a5fb-163da025c5b5", "sighting--7347af28-e125-4688-8aff-272685c52658", "sighting--0e7c33c5-9256-48e7-b8f6-f71ebb33c12d", "sighting--0532a2c4-dfd2-40b3-9e31-5356b96ccba7", "sighting--dc0d8c83-fb44-4db2-b3d3-0c2ef1b7d390", "sighting--2f4f7e41-3195-4969-8087-aadada9d06d3", "sighting--63e00f5f-bb3c-4961-aad3-2b587a7029c9", "sighting--965b3c32-5d25-47d6-ade1-b74e3cd9ee9c", "sighting--de73b5af-16fb-4569-8ef2-47621ad678de", "sighting--b9334275-4b49-4646-9342-4d586ba8f3e4", "sighting--b091dc74-d757-4d74-ba2c-593aa67d8205", "sighting--881f4540-7eda-4870-aeec-e2c2638d2c7d", "sighting--5fa5baed-f415-4eae-9c46-b8d42628a339", "sighting--5d5cc868-c28d-41d7-b41d-c548be99fc25", "sighting--2ea664f5-ed6f-4576-b1f4-df7d06462772", "sighting--d6d83235-c8c0-48c1-a63e-fd735ef1ac54", "sighting--fcb08295-d851-4ffc-9e18-ad56a73f93c1", "sighting--5b4beff4-da0e-4ee2-8b90-41c80a7999f6", "sighting--a2253e26-b8bc-4594-a8b4-1edd76482583", "sighting--ed02272b-33ce-4525-b214-8c9047146b05", "sighting--e9f4e012-a142-48cf-a158-a9d808341989", "sighting--a16587c9-1ff8-4c1c-97c7-0887d21a4182", "sighting--8010d578-70e2-452a-90cf-ea7eff8e86ba", "sighting--5bec0644-682a-49b4-bc63-4af3025be7e7", "sighting--1f62dca3-8fef-4adb-8af9-ba7da488b175", "sighting--41ecc519-4278-4c1a-a6e8-d49bb0175c5c", "sighting--813431f1-d355-415a-a198-348d2fd053ef", "sighting--b6b7df74-f685-4946-9112-4cfa036e06fa", "sighting--1f3a1882-39d7-4d02-85ab-a6ab33e2ee61", "sighting--ed270800-4ce2-48fd-ab51-29eef9fa221e", "sighting--3d41ac25-eb77-4986-8381-ab40bdc856e9", "sighting--025db09a-e1fb-4469-9fb1-d3abcfb36d9e", "sighting--b252f6dd-f9c3-4ef4-b8a1-81fc20f3e7ca", "sighting--531c3c73-ad59-43f7-b1e8-7bb783ea4096", "sighting--79c635dc-932c-4a11-b269-204851e5d042", "sighting--a7d4b651-0d5e-42e5-91b0-3a89a132a4f8", "sighting--efc4b228-5bda-4ddc-b7ed-72e0beccd929", "sighting--ad3465a5-dd78-4306-99af-b19e416aa774", "sighting--95390c1a-bc79-4f12-91e5-7d163cbd56f0", "sighting--a02528e0-e48f-4247-acd0-b0629745dc6b", "sighting--1369f8fc-290e-45c2-a2b9-4dc57ed039b1", "sighting--11a4b3d1-6f2d-4f27-811b-9032365efc66", "sighting--eb7a976d-2d07-4e88-ad20-22436d253d47", "sighting--3880b4b8-a8c9-4a3e-9d25-ab04b6558348", "sighting--5cf3df72-51b6-4a29-83bb-7702e865f389", "sighting--82a338ca-1d02-4e13-aff4-bedcf473a712", "sighting--417643c3-aad3-4df7-a01d-f974ad44015e", "sighting--470fb1d8-5818-451d-866b-b2b3d75800c1", "sighting--986a886f-c6a3-49ea-9765-3b34ff527867", "sighting--0bda9423-28e7-4997-8b1c-5e25e20b0b79", "sighting--e9069c34-9420-41ac-8a1c-148970fa7b0d", "sighting--0ccd87bd-ce37-466c-b5ce-ec7bcfc93742", "sighting--e757dfdc-733c-466d-99af-280602c8ce36", "sighting--6ae7400b-c352-42a8-88ce-dd548515ced9", "sighting--b57d1a41-7120-41fa-8b81-41b5a09fb9ce", "sighting--273bf558-a94a-46bb-a91f-176ebaf1307b", "sighting--21bfc38f-c7fa-417d-a1cd-104c9bd12ac5", "sighting--61ab69ad-90ff-4dc5-a58d-325db25f6be2", "sighting--200745b5-5e47-4cfa-912e-c74a7657e51b", "sighting--7cd87088-5bb0-4a7b-a76e-56e79633aff8", "sighting--0bd164dd-7613-48b9-8c4b-463412b07b4e", "sighting--f41e3521-40c3-4e12-a1d4-cff3fbae5fb4", "sighting--93568f1f-a3a1-4726-9792-37b0fc0f605b", "sighting--7f00d870-21b7-4689-8bae-ee2885ec34a2", "sighting--9ab2118b-832c-4d46-a314-3abeb2b63bf8", "sighting--ca0a541e-d1a4-46a4-8772-1909bb535785", "sighting--09db1335-2bc8-49aa-b49f-434ca9ca5c15", "sighting--829aed27-8317-4143-8a79-def3fc4e3efe", "sighting--1f1f64be-4beb-4b8f-ba5a-ba143eadd6c6", "sighting--184d3c10-e20b-4227-ad73-16db4a9e441f", "sighting--7eced4f0-13bc-45c7-a448-0aaa4f46e8ad", "sighting--911f7515-6247-489f-bd09-06ca356bc14b", "sighting--cee2944a-8876-42aa-ae0a-1da28cf0a341", "sighting--90f9371c-83f4-4663-8921-0895dc81278f", "sighting--0cad4e3f-cbed-436f-8772-37acc1e2be9b", "sighting--9918fb67-6a69-4aa5-9a36-5c0af8c13db3", "sighting--7b1e1a2d-6efa-499a-96d4-8f5777042a2d", "sighting--a11a7b7d-6128-4315-97ef-c090ef0a5a31", "sighting--5f8f0665-4c1c-4b49-9ad4-e4f42d9d6919", "sighting--80ae1792-15dd-4734-be86-c0031e8f80a8", "sighting--397ffb3a-7b24-49e9-9d46-d94cbfdb9f30", "sighting--e011e27d-79bb-445d-b237-288eb8e4c7d7", "sighting--348f8b7f-2c4e-498a-81a7-dea6da74ca17", "sighting--63d5cd0b-ee3a-4b6c-9a35-a6a10e216400", "sighting--b806b198-fe64-499d-b218-c571a5bb19d5", "sighting--52900063-1e31-464b-96a1-ac2363fcad29", "sighting--522b296f-8d3c-4c85-955f-4102a57d80c7", "sighting--fc4b10ee-0559-4663-a76c-f69ee1a9abe1", "sighting--818d73b9-e980-4ad1-a973-4d2e4514e38d", "sighting--2358b44e-a268-4183-9224-ef2b31d49e2b", "sighting--c5019ca7-2008-43bc-8d92-74d3bb2c9078", "sighting--fa50b45b-e7ae-486d-8457-ec499a9c63e4", "sighting--cfbf0e55-4a3b-4c00-9580-a2122d37279b", "sighting--157d9b6b-4f50-4f0b-885b-76d18c1205cb", "sighting--9b1f9383-1b50-454f-b6ac-3c2dd9d314b9", "sighting--00572a09-fe31-4204-9cd6-9bfd00615cd2", "sighting--55487c5d-2268-499a-8ef1-9b1cff1d6928", "sighting--c16f59bd-c889-4832-9928-e8208a0a439b", "sighting--e39db9ed-e94a-4e02-b19f-5e15cbcca8e0", "sighting--53a5402f-1039-470b-985f-7e874e4f38d7", "sighting--c294701c-64c2-4388-a524-047a3edb13a1", "sighting--bbd8dcac-c688-42e0-a044-f46457769d14", "sighting--ec89a6d5-d6b0-42d8-9ee4-802d2b509690", "sighting--39b46a1c-5632-4dd3-91b3-1547813b397a", "sighting--81466594-5425-467d-89a0-133e52e14cf0", "sighting--d0a757ed-87d4-4dbe-9aa8-24d006b022c6", "sighting--e85cc39b-2c5d-4fe6-ab67-6ded39182202", "sighting--0c77d78f-b9f5-484b-a215-81820644f8ab", "sighting--d69a2137-70c1-4690-959b-b7a260371003", "sighting--26150afe-6dad-4ccd-a432-e13b644c5d3c", "sighting--45df2841-7eb4-4d5d-a0ce-71f6d4e88e65", "sighting--8d084a1f-eae2-4ee4-b8f3-ffb8b396ea6b", "sighting--7a6ef13f-7b9e-4f00-84f3-c0378d9b3048", "sighting--6f09b04d-601c-4088-aaf2-da70153a95ac", "sighting--58cc6528-108d-4886-95e7-afa6a9dfb3c4", "sighting--e5333de7-8d2e-4586-ae56-1848ca932310", "sighting--c724f9cb-06ae-4fbc-b721-7624d2e1149c", "sighting--4b816fe6-c4e4-4e00-b21d-9f5cae595df3", "sighting--035d9fa9-53d4-432b-a6fe-82f7e5ea1237", "sighting--d01f760b-24e0-4b20-a7e1-471fb49b83c6", "sighting--64828f30-a503-4cac-a9b5-1dd00538080f", "sighting--116addc7-3018-4aaf-b50b-2ab0a55fa5af", "sighting--47df5e49-e6a8-46a6-8643-d331df141cdc", "sighting--f8f4545b-6333-41f7-afbc-93d8444865ba", "sighting--21b3fc92-868d-4e50-969e-d225d5378e0a", "sighting--46d42865-a94b-422c-b65c-ce826c014c88", "sighting--79823fd7-31b5-4266-8bc5-0a7ba40e695b", "sighting--98bc2623-8c2d-4f3b-9fbc-b01d3dac40ce", "sighting--44a9b6de-7564-464d-9928-8584bfa1980a", "sighting--275e7cef-e5ee-4346-9255-4b6849bd5657", "sighting--389ef8a4-ed51-467a-a065-e03350b426cf", "sighting--7d25cbee-ade5-4965-9e36-7a7dbdc8586d", "sighting--2bc4cf8f-5374-402a-85cd-78b9d099b3bb", "sighting--1c9ea3d0-4d28-4525-abdb-a47c06ab083e", "sighting--6260f9d8-1e63-4aa5-b64d-493e5daf094d", "sighting--cd38b26f-64ea-4720-91c6-d8dc3b0e44af", "sighting--b4c1a9fd-6122-42b1-90ac-8d3e9121965e", "sighting--e55216e2-f321-42bc-9db3-65296b456d2a", "sighting--066b480e-2266-45b3-a843-e06b034317e6", "sighting--c743c504-7711-43c1-b4a0-46b44b5754ce", "sighting--a9f4f7d0-2ece-4ac0-8723-7a7c4c51513e", "sighting--d66ab18f-9cfc-4a3d-8525-1088c83e92c6", "sighting--64061836-d96c-4b84-a5d1-ab45ede174f8", "sighting--5093a7f9-ef4e-4009-be17-de4b30d2a1ab", "sighting--76687a45-9ca7-4c56-ad09-527595641d1c", "sighting--c8fd6e3a-c88c-4ce7-9944-d5ef4230979c", "sighting--6d420269-727f-4a95-8bdb-7663ee14a9f6", "sighting--5ac27179-a606-4217-9e35-8924481719de", "sighting--0f5fa1f6-3af8-4d0b-93bf-93eafaff27af", "sighting--b9341f53-92c7-4af3-982b-2d4a29fca569", "sighting--73b0a433-a8f6-4ffd-b810-3528f7ef28c5", "sighting--cbc72fd8-4e4f-4763-bbaf-cd0393ad6b07", "sighting--9043f008-3577-40b1-b78b-ea435484be42", "sighting--a6db5cf2-5709-4c35-b5ef-81db023726c8", "sighting--9fd4a316-8a5f-4dd1-beec-277e3754a034", "sighting--124b915e-c237-46a9-92d4-6cf3a193a086", "sighting--da101e0c-6adc-40b6-b224-b25ec9d1117d", "sighting--4fa9ffc8-3b06-4ea5-84bd-c624d4589832", "sighting--c4a10e81-0418-434d-855e-9a29e0e584bf", "sighting--64a3423b-66c8-48e1-ab6c-a383b399acda", "sighting--668a923c-1972-4512-b4fe-1a1df5d57c50", "sighting--11ef237d-a987-471e-9d42-48f25464bf0f", "sighting--4efeb2bb-f440-4be3-b27d-0df1b960b556", "sighting--d9125ad6-a6d9-4022-8a05-9d89fae5506f", "sighting--9c819c9e-902c-4edf-b90e-923f50856675", "sighting--4ef5a985-a862-44bd-953b-f06a8d135115", "sighting--bac6ccdb-4189-429a-ba3c-934b9f81d6ed", "sighting--472cddb0-7315-441b-909f-83957deec6d8", "sighting--5e9958c0-7cb9-4ae3-81bb-68831ff7ec45", "sighting--fc99b45d-a071-42f7-908f-75c0c7d6fac9", "sighting--23b21964-0b03-4a09-8d66-f05af1c4bb8d", "sighting--42b8693d-59a7-41ce-aa0b-7bfb266f9abc", "sighting--a7d6a0c1-2198-4c22-8862-ca8901271ffc", "sighting--23cd3032-75d6-418b-b0f5-b00ca40b4d35", "sighting--7d888ddc-8449-4737-86d0-dbd67fd5ee8e", "sighting--43cb97d7-ff38-4048-8867-f06eb5e41d9d", "sighting--5bae55aa-9f94-4055-b930-b295ace2256a", "sighting--4596b73c-c354-426e-b19f-8ed91215c7e8", "sighting--d7c55378-b29f-44f5-8794-021a02da8a47", "sighting--60d7e5f9-c28a-41c6-a510-40029770c211", "sighting--f74c3151-7848-4d93-9e5f-7d01e7c0fa31", "sighting--55570df1-9036-4768-960f-db48c1cc5ef4", "sighting--7a2ba4c8-38f9-46fd-9046-c1e2362bbe1d", "sighting--fe99033e-0c94-4a75-8596-575b21814b49", "sighting--dc79756a-3bd1-437b-8fee-69a71fa4b532", "sighting--f4da523d-17bf-43b0-9357-12ccc05050dd", "sighting--12af1726-0a6b-4955-9545-918e34c674a8", "sighting--7e75d45f-0918-4de1-97da-148a1138f4ed", "sighting--3ebdbdad-94ec-49ac-9f08-f99dd89f5ded", "sighting--dfa5944e-76a0-4906-a202-33d3fd092f4e", "sighting--ec5ff82a-1463-4ae6-a30b-a6879a67e4b4", "sighting--ba3d7f80-867b-4792-9ee6-3b6a8ba8c59b", "sighting--5847e919-b9d4-4ddf-806f-f62282372772", "sighting--0d83d24f-b572-4221-bdee-b00a53f79921", "sighting--f9383792-0133-49c4-8a6c-cd76bfd62d25", "sighting--968e7571-5455-4c44-8329-333ea2ec10f3", "sighting--b5e4e3bd-dab5-40f0-88fe-e0c266358d87", "sighting--be59d113-e848-46d0-ba4c-5e97863bc6d2", "sighting--448bbbee-2496-44b2-8e0b-9a861e7594c1", "sighting--272f33ab-1d21-4974-9e14-6d35a24281f0", "sighting--5497c1c0-3701-4512-b466-d08f6733bbc4", "sighting--d0eef250-d710-4e70-8aea-cf8762438897", "sighting--e4c70543-4f91-41e0-8ff3-3c28afa04921", "sighting--71975990-de04-44ea-babc-339b55539383", "sighting--cce76ff2-e59d-4a13-8088-cffab71a970f", "sighting--006873b7-5945-4401-9885-337805e2458f", "sighting--deb681ed-e4d8-4a7c-8fa5-45dbe8faea2a", "sighting--5bf2e796-e808-46d4-af9f-a24b9003e4b8", "sighting--420fd6b3-2461-4ca5-abb2-4f97f3507547", "sighting--910e1fe3-106c-49e2-8bfc-cb02abe839bc", "sighting--f5e1497d-4cdd-4a47-ad4f-18395282dcc7", "sighting--f76ed141-3515-4683-834a-c49379fe2770", "sighting--1cd543f0-5a9e-40e7-a01d-5f8dfafd22e5", "sighting--40d833fd-c202-46f2-86c6-cf49310ac1dc", "sighting--d53ed167-c82f-4475-ac7b-70e84f72d170", "sighting--c57b5304-3734-4e5a-860b-ffe7192c1171", "sighting--f2c845c2-6f3c-4f63-86ee-7c354d1f1e1b", "sighting--6e8c1b6d-d37b-461e-81a1-57b834915e10", "sighting--4d7cc084-6013-4e5f-9a4d-d5c806fd7ca2", "sighting--0c3590ff-04f2-46d6-870c-ad95cc204989", "sighting--763ff320-c01e-4da2-8ec2-2e58aba4cd73", "sighting--1e488331-9a2e-4411-942b-ddf51b44d161", "sighting--9373258b-2c1f-4269-b853-3bd251808d54", "sighting--41bafc31-f7fc-4fac-bc08-9736fef021a4", "sighting--37cb54c3-6a6d-4ad4-a0ca-2852a3493501", "sighting--e9b8b33e-05fc-49bc-9acd-83f6fccc35f6", "sighting--61bdad47-4034-43f1-9abf-d80ca33fb323", "sighting--b347e487-417c-4817-861b-112e3cb262af", "sighting--b2c8ac2f-33aa-41db-9f81-7944bc0fc4d4", "sighting--4a83b6ba-ece5-409f-b0a4-3e6b53efabe3", "sighting--32a9e693-b30f-4bb3-a547-277345a0ecdb", "sighting--3656e120-1f55-4b10-a391-0bf01d3d5f77", "sighting--b2618b56-3a26-4ea9-9699-5f82c29d587e", "sighting--6a2d21bc-e652-4d37-b0cd-ddd684235438", "sighting--6489e975-1bdb-4b7a-ab7d-c7cb2040e66c", "sighting--182a0ec1-8677-44d3-9d0d-c9b191e89e5e", "sighting--e155473e-3446-4156-863a-28607d455f13", "sighting--5bbffe26-c159-4aa4-a7aa-6548d3ebe28f", "sighting--2ba369cd-cb11-44c5-af26-98cdea97b5a0", "sighting--72b3a3de-371e-4b7d-b18c-57b7d3cfe1d9", "sighting--4bc26c77-dd73-40e3-b7a3-fae84d0bcef1", "sighting--095d8716-0d9b-406f-9e1c-c61412d9748f", "sighting--0a6bdc35-b074-4c7a-af5b-e5a1879f7d99", "sighting--1a6ba64f-c086-4180-b49a-06445d6d6380", "sighting--e6bee377-47a7-439b-b891-951fc13eb861", "sighting--fc68d3fb-28a8-4d73-9e99-9bcd11895836", "sighting--f4606da4-4b97-4756-94a3-9c6ea8697cf2", "sighting--54963b5d-024d-4de3-b92d-8bd0f7051518", "sighting--2ba4424d-2ca9-494f-a8e6-0e055cade139", "sighting--9cf2a89c-78a8-421c-a159-58b435058dfa", "sighting--7c3d2a5d-dd6b-4fcb-a4ce-b51bb92671cb", "sighting--0c97e057-15c5-4af3-b330-094c5410d198", "sighting--fab38e6c-4e09-4aee-8888-2de1eda0e407", "sighting--d2b38ec9-f666-4b9a-948d-b6c529691af0", "sighting--20621bf2-cd34-4e45-aad0-96422d032202", "sighting--4c40889f-bcb5-4773-84be-b1fde0103a69", "sighting--2e14f670-bc09-483f-9c13-36adc4ea3da7", "sighting--d89822d5-ae28-4fc7-bfe5-feebac830a73", "sighting--f561d272-79c4-4f69-821c-253c981071d6", "sighting--c7492bc4-8ced-46ab-8c5a-15004db6eab0", "sighting--e5dd4478-ed2f-4b00-8ca2-fbee85a67a5b", "sighting--4769735f-64af-4339-a836-9c910c090a46", "sighting--0bd29588-e1f4-4d8d-aa2d-bf34e5e62b2f", "sighting--583f1743-142f-40f0-9610-dd13fd47545e", "sighting--58434162-aed6-439e-b6b7-d464b7dfac62", "sighting--33cf9d44-e999-450c-86b7-6f9fa5a64e51", "sighting--0dcbf427-2eba-43e1-89f6-066abbc5425a", "sighting--5bf4f3dc-8fed-43b2-914e-fd2e2e88e219", "sighting--6bbf1bed-c101-442f-b2c7-8df6b5ca1e40", "sighting--c54792af-6c5c-4d23-9bb7-2bde55bc1a36", "sighting--b91ae29a-6358-45e9-acc1-d640708be254", "sighting--d7cae744-76c8-49c8-b9b8-f260568f51c6", "sighting--dd4aea62-5e64-4e94-83aa-dfb1328fcd39", "sighting--ccaef4c0-ad38-482a-905f-43bfd4bde334", "sighting--685b0de7-d2d0-4e77-b434-5f72fcbbdfff", "sighting--c3ecba79-884e-4b09-8334-63e730538bc1", "sighting--35f09a30-a1df-4739-9487-2f3bacfd2f50", "sighting--2b66600f-8e16-4a3e-a0f0-ff17536eb044", "sighting--4d1d9b31-646a-4460-8056-58ed788c3df8", "sighting--f43b3300-ae52-4541-b04d-06f40354318a", "sighting--60c698e8-8ef2-4a34-b2e6-a5218a755957", "sighting--f9306747-bf62-44fc-ae36-03ea0f7f50da", "sighting--d019a473-045e-46d3-8661-7a69aadf5c32", "sighting--9ecc4a3a-ed31-416e-a394-04ed05a2e68e", "sighting--955dfdb7-b54d-4da0-9c88-a930d118333e", "sighting--8215367b-3178-4379-ac3e-52aa72be03f7", "sighting--dfe6372b-01fe-4c05-9af7-a8fd0297b09d", "sighting--b935eef3-874d-4675-9f41-7d499096dab1", "sighting--db59edfa-01e5-455a-b056-faa17f7b2a4b", "sighting--613e95c6-3180-4fe0-8b29-2c0d028397e0", "sighting--3b4beee9-cd05-4e3f-9e4c-fe667a40fa60", "sighting--7b74e823-7138-46ee-b35f-c1f7e35b3044", "sighting--4a6d45ea-c8e5-4292-9793-0191755a0c5d", "sighting--5a1ad252-20ed-4f10-83c1-bae15794bc7f", "sighting--c1ebcb21-e358-4dd7-891a-6261f382e796", "sighting--afd0887e-75ad-448f-a76a-978942becdfa", "sighting--b2abc955-069f-4dca-9661-dc969690cae1", "sighting--3db9f243-0554-4779-b9a4-383ef84ff1ec", "sighting--36ba4b4a-184f-46ec-a9cb-40ecddc7c53c", "sighting--01463299-7859-4d8d-abc7-55d96aa226f2", "sighting--cdb81e52-e819-4856-bfda-5da058e2d955", "sighting--63623118-0777-4d89-ac52-88f558319afb", "sighting--0a41a288-e8ae-4d72-9723-ad00a8f82b3a", "sighting--5fa8f8ae-05a7-44dd-b298-6979490e06c2", "sighting--a784902a-a31c-4dce-a669-a2d35914b87b", "sighting--9a077b32-375f-46ce-b171-610c2f747020", "sighting--a1340537-f864-42bd-b9ee-2697f9427ab5", "sighting--ef7ad75b-7c86-463f-b9f3-28bfd28ca4d4", "sighting--21e22bf4-4a4e-49c2-8647-bbecd13ab8c5", "sighting--744d0d4c-f08e-4bec-a553-b6c0722394f7", "sighting--b40860b3-a64c-4a33-8f62-56e934982988", "sighting--14a52661-d21a-484c-80c3-e511da65ec60", "sighting--c2aedaf7-7d65-4750-a83c-9b7e5e705ed3", "sighting--b9c41cb4-2524-4d4b-a4bb-a120e2603514", "sighting--9404cb51-4631-4050-88d4-f79ef16e08e0", "sighting--92f374f9-ffaf-482d-ae96-3cd0448d0b2f", "sighting--60bbec05-8a4f-4f66-878d-fd7eec34bb2e", "sighting--54ca253f-b369-49c0-9b43-e973496af200", "sighting--6f9888c7-5f4f-4191-87af-af49f3f5ee36", "sighting--f32d095c-ca25-4185-89f8-c529efefbbee", "sighting--50f54a45-f9e0-42a8-bb13-620eab13baf3", "sighting--49f87d39-5209-47ff-b779-fd702a6b5835", "sighting--fbd24c39-dc96-426d-9107-84f70df052a3", "sighting--e685b673-433e-4515-b48a-b86088211713", "sighting--c9e0b2ab-7e68-4bb3-bb31-bc421f101928", "sighting--b14e9682-da56-44cd-bf98-921a17a6f12d", "sighting--7a07524c-8231-49d1-8dc7-52ff15ba52e3", "sighting--850064a8-f78b-45f4-b4d0-957d9fe3c874", "sighting--baeb3242-1c5d-4111-9422-1b063119986f", "sighting--33bd2275-a138-4612-be34-9589c813ca6b", "sighting--5c83d0e9-db57-4af1-8f0b-4c4eb78128dd", "sighting--bc9fbbb3-b370-4d41-8733-97860139bfa4", "sighting--ae4d8ebf-ed7b-4bd3-9774-70dfa716d128", "sighting--517c2e0a-9655-4299-8c6f-de60af969ebb", "sighting--902bed47-9919-4fde-bef8-a8e39db86be6", "sighting--c9c0ed88-27ea-4b20-8e7a-aa992f2ffe0c", "sighting--c82e9498-8f78-4cb0-8df0-7b3b4b79d95d", "sighting--5c798003-2c1d-4aad-9cae-1bd5e51feeda", "sighting--2a4ec8be-afca-415d-9aae-d66941f8839b", "sighting--864328cb-b730-4c04-9da8-7ad7725e0639", "sighting--cfc053cf-5e09-4619-9310-fd45ddfbc370", "sighting--1b3c3eb2-e51b-4a6a-81bf-045f16540e08", "sighting--8893d000-8014-46df-a6bc-e1d884f2ec9f", "sighting--88cde399-e1e6-4c64-a5d8-b24810677b27", "sighting--a153eec1-982e-49fc-9a11-81515d5a8d3e", "sighting--ec1e0bb9-1fe0-4f95-b604-de0ee5a072de", "sighting--32de4221-25f2-4bb1-ad44-6abe599029d9", "sighting--eb204df0-0a27-4839-ae54-51058852ca03", "sighting--28c0b3b6-9c06-4843-9dda-9ae27c2b0a79", "sighting--cb46a470-3954-46b4-9097-44521f8e2ffc", "sighting--33099697-c9ae-4f7b-85c8-0844e380fd82", "sighting--08256618-a7e6-4832-a43a-94ca06915495", "sighting--d7b72de7-2598-485e-9e35-ce967e7a25c1", "sighting--83c5a84f-9c3b-4b04-9db0-493a8782d28c", "sighting--e12107ac-0dc2-46df-960a-ab25fc2f8b08", "sighting--e4a10b05-b978-44af-bbc3-e9be859a9cad", "sighting--a0ae73f3-ba01-4e0d-9a02-81ceff30a54d", "sighting--3c8c5009-4df8-48eb-b180-ce6ad6d9e1f4", "sighting--d69997f6-34cb-42cb-8da0-0dea6158b1f0", "sighting--709f6b9d-8581-47e4-9ca7-363a17206629", "sighting--d9d84487-13d7-4f5f-bad3-8057e14a2901", "sighting--f2eb4a60-f733-4bd7-915d-5a8bf6884193", "sighting--8240d312-8fed-4055-ab00-281c6f74c46a", "sighting--d3f11012-8e9f-445b-b190-6bc3139033f9", "sighting--a025d948-a170-4ef3-83f0-fc918f39bca0", "sighting--bda2bed3-d712-4a56-871a-f5ca725b4a5e", "sighting--a17502da-9fbd-457e-a60c-647a7ecf3e74", "sighting--981a8f73-ad20-4a52-9767-8ad21990e047", "sighting--a1f24ece-1ff6-41ad-9335-fadd275163e2", "sighting--68e33593-203f-48ab-a260-0bcdd273bd30", "sighting--2d8ee8d1-fecd-4d78-83f2-c45d789cf56c", "sighting--f98512e6-ecc8-401b-829a-3ac27b5aa90e", "sighting--9cb8199f-74ad-497d-85ce-75b24949ac24", "sighting--503c589f-5229-4752-bd76-4b6f3d2a58c3", "sighting--1b6a532d-0465-4ff4-8b5a-5d53b3baea1e", "sighting--9a12cd58-4ae5-4e32-81b7-b505bb6a2079", "sighting--931537cb-bf8a-4cb1-b493-f57baa303be5", "sighting--d7671c5f-401b-4617-af50-b5b1f82a4c3c", "sighting--699ef585-54ef-47e6-bff2-3d1e4d66a5d8", "sighting--a89a1e52-bf2b-41a7-a0e7-fbe4b32dd1dd", "sighting--23a659bd-b508-46fa-a0a3-920611a67841", "sighting--4cd52dc7-abc0-4842-a85a-3262c4ce6fbc", "sighting--68f10396-3b86-4cd8-a918-d0fd4697b779", "sighting--82cd4c59-7ff8-4d49-95fb-85b229650601", "sighting--e790723c-88bb-4366-aa66-3d1dddb5bf82", "sighting--5baa9140-f7c7-4e30-966f-43512c078523", "sighting--9033527e-fe3f-48c2-8b15-b07a689e8c6d", "sighting--406f6bc3-753b-46e8-9834-a7e65af12aff", "sighting--2889db49-2c86-46b9-93f6-8cebbc0282ff", "sighting--e06352cd-ba9e-44bc-8751-e1a31025a189", "sighting--0d0a431e-5c06-4b58-83d8-68eb1073deea", "sighting--9b622fdf-61a5-4bf6-8ae6-0467f3abd02e", "sighting--fdd9ff30-2724-4ff6-8520-25a2ebea7e85", "sighting--8f89b07e-3171-4767-8eb4-4f6cde814731", "sighting--40f130b4-ecd7-4394-9c86-d467f13dfee8", "sighting--270f5d56-2879-4b16-9d13-bceb188dd4e4", "sighting--abb992fc-cc5d-4b11-aced-3375e1209f7b", "sighting--4eefd46e-1248-430e-a21a-76656b97797f", "sighting--5e5d2795-d66e-433f-9514-4f3b1d7f7527", "sighting--7a1c6276-bb67-4501-924a-39fd5b4e59e2", "sighting--984e09ac-e567-4bab-898b-d3a872aba47e", "sighting--3fa42b70-021d-45cb-84eb-00ddb834e4aa", "sighting--1e89b053-6af6-4197-b2a2-7a732529a39a", "sighting--1a3d97f1-5c27-4d7a-a747-51669bad4b12", "sighting--105ab1ed-2cbf-4818-8174-49ece117519b", "sighting--3b654492-ddc3-47ff-833b-55ac26ee380b", "sighting--638f79f0-d496-4bf4-a8d4-9eb6fa5d141d", "sighting--793f9975-55df-44d0-8e8a-cd81dfae211a", "sighting--384cc27c-bdf4-458a-b67e-2b74a312bf3c", "sighting--51e7bd11-c1d8-4944-bac3-7867fa22e3ce", "sighting--49f8858b-6900-4c23-8ad7-a76656d9b119", "sighting--6daa4ce5-0aeb-4b92-a5d3-014c84043fe2", "sighting--023ffc51-94e8-48bb-b30d-50821ea053b2", "sighting--ae0e1fce-f444-43f3-bdb8-08927929c9ac", "sighting--af7910e0-ca80-470f-83c1-2883d98798f1", "sighting--7cccb385-f75f-4c8f-ab8b-cf7590dd8bd2", "sighting--9b44477e-ff03-4193-a9e9-4f12e9f5a4fe", "sighting--d3ab8d17-7937-4a59-ae55-f7dc88f20d74", "sighting--6fa28835-6bb9-440e-93b9-3a1fa2a297c2", "sighting--8470dae5-5228-446e-82de-e9c82d6915a0", "sighting--3e85bf61-2ba9-44b2-ac64-6e1faf504bc1", "sighting--aa516191-1278-4ba8-ae72-58fdce1cbada", "sighting--435e6244-11fb-457a-b8d3-6c5b680744ac", "sighting--6286cf3e-8b63-41df-a39d-3a02161ab9f4", "sighting--79f9c5b4-9c89-4ab6-8496-8d9f86d308ae", "sighting--90e80ad5-fffb-486c-9ef1-9631703a8f13", "sighting--1b5abc1d-6559-43ee-9701-4d75169ff3f1", "sighting--2d760f35-ed08-4429-82c9-e33284a58e07", "sighting--28ecd7cb-7881-4274-96ec-8236a3bee519", "sighting--672a1a5c-27a7-49ff-a29f-bd2c6d1d034d", "sighting--12739548-e776-4e92-8f3a-3dcbd7c0143d", "sighting--ca3da0fb-7ea6-42e1-9148-fe71c4d8d05a", "sighting--5509e81f-44ec-4a66-8e34-1e405f1e4657", "sighting--4037b0c1-c454-4931-a91d-53e7f70a8d8b", "sighting--79790aed-47b0-4eee-8d93-eae56248d6cd", "sighting--339452df-469b-4fec-b211-89565ee8ab81", "sighting--d36c4db6-e51e-43fa-8a2e-47e3b23d35a7", "sighting--c52761bb-1422-4f5c-9430-d71e7b36c110", "sighting--cb24ef27-b79c-4e5e-a531-7fd78654c5b3", "sighting--1555862a-dcd9-4441-92be-634a56fea55c", "sighting--0bc6bb3b-d0c8-4b07-9af8-84ec6fa4116d", "sighting--b6cfde06-a44d-4f94-987c-98ca1e0b7882", "sighting--d6197a73-fd65-45e0-a9a6-829f5a9a1815", "sighting--ab8415c5-6bbb-46a3-832e-c5385cda3a08", "sighting--97e5675e-7407-4f11-b10b-e1c56d7dc592", "sighting--4e0e0e99-b1af-4147-b99d-f3b98201cca5", "sighting--a41b5f35-357a-424f-aa16-850b2864e888", "sighting--c80ba3e4-075f-4f8e-b12c-b3a837b1acc5", "sighting--b0822191-0514-4f69-afd7-4c6d5cad07c1", "sighting--e75eaa55-cb11-44cb-ad07-9816a7853131", "sighting--b3e29d19-85c5-4e1f-8dd1-65cfe59410c6", "sighting--4d7825ca-7dc3-4ff0-be16-0a6bc7ef82ac", "sighting--5c6e4f1a-0a22-4491-806d-9a7cf857dd53", "sighting--abf604f3-df6c-4ab9-9a12-8edc9d212c2b", "sighting--413bcf93-541c-4606-b691-1143732670eb", "sighting--b0e7bed9-264b-4b18-8d5e-52ecb04c159d", "sighting--02af8bc8-ca54-43ef-a0d1-bcb3ec62ceb4", "sighting--76f2f61f-19ff-450c-b98d-64e1ec6201ae", "sighting--ffb96ea0-2c66-487a-b298-768048a4a9d3", "sighting--e2d72178-2202-4680-8f0d-dcadc13c475e", "sighting--d5f3d166-4d55-4578-8f60-a892df2760c5", "sighting--59fd04f5-0146-4fa7-a9c2-43a6880af86f", "sighting--23525cb7-8823-4b8b-b44d-e54c87abf04f", "sighting--1d2c9e3a-f164-4e73-9d07-9c8e8735293b", "sighting--c2bb815f-947a-41f2-983e-700e41cf8dab", "sighting--db18c211-a009-4e2a-ab6c-38e7017fc4b5", "sighting--d55cfb8c-be75-4ea5-8c18-bd6e8601d112", "sighting--3f515df7-d5a1-4981-8251-390bd9d06ddd", "sighting--167b1c60-e9f1-4f15-93c9-4934c5afa0b2", "sighting--3f649749-56f8-4877-8fd1-88c963d35b12", "sighting--b5c75eb1-1cc0-41bc-b57c-49961ed234cc", "sighting--24b8cc47-4802-4055-82fe-ef376f222ac6", "sighting--8624baf9-ab17-4ee7-83ef-d916eede75f2", "sighting--29f4cf0a-b1d0-4d02-b7e0-87cea6bbbd00", "sighting--8a0f69b1-05c3-46c8-a4be-b36850d358f0", "sighting--8b0859a7-e10b-43c0-a7b8-71e3dcdaccba", "sighting--002132ab-c8bc-4c5e-ade0-20f3b2ed34ff", "sighting--3d70eba2-6df3-43f5-a12b-09e347bfbf20", "sighting--eb591fd2-72b0-4683-8c8b-94087d117365", "sighting--0efef7a0-7cf7-49d2-9b10-db4e84d258cb", "sighting--1c0c50a6-c1e1-44e4-81be-be74287d4521", "sighting--86d0f79a-07f3-4365-be82-a2eeb6640355", "sighting--9d7aaa67-fed5-4102-bce4-02f14184ce5f", "sighting--a1c4861c-fb92-4c87-bfe5-90cd5afdee59", "sighting--3918abaf-f881-4704-9597-1fee8fa3593b", "sighting--b6ca8ce3-4d60-47cd-859a-c64295a2b0c9", "sighting--8152380c-7413-4338-bd2e-8166d882ca83", "sighting--7569db1e-9b14-4d93-b6be-4eea9c2cab02", "sighting--b71d6e6c-fc75-4d27-b427-3cba5ebf23ce", "sighting--0df1de1b-7d8a-42b6-9e7b-4558ce4a1e47", "sighting--2341b328-9736-4c29-ba8a-05b1cebc8c46", "sighting--26caa63c-f5c5-498f-b974-c5b0dff70e2f", "sighting--b650e2e3-0f15-4ba1-b02b-b37b694f6f56", "sighting--4649678f-954a-4acf-aeca-a54d33b68f60", "sighting--f0d7e212-b57e-4931-8478-9321e4650372", "sighting--1da16095-e580-4a1b-9748-ba0fea427ef7", "sighting--46d49159-eaf5-4aff-b412-975377caf4ab", "sighting--601ae919-8b93-4dc3-a2f5-da88d277cff9", "sighting--74a60c50-b311-47ff-926c-e28854aa7f0a", "sighting--eacaf448-d5dc-4c7a-9394-9bfb2a5ca78f", "sighting--d80d6382-8a62-4c7a-90c7-c5865372f7de", "sighting--647d7899-2c29-410e-91a8-335858747e17", "sighting--fcc7f5f7-a9f5-41e7-9d64-df2c75d46de3", "sighting--1ad12fee-6397-42f4-80c5-e7932be2fee4", "sighting--c37a96fc-62e9-4c13-a224-8a9babf2c5c5", "sighting--11fa503e-8a2c-495c-8a04-dbed131e6f05", "sighting--5f82afce-3bb1-486e-ac08-8c2659955622", "sighting--6a07a785-1a3d-4ee6-8065-cf4016ff90bc", "sighting--01fdc28b-ef19-4378-b657-d2b8ec4afa5a", "sighting--fdb4dbc8-4de7-4270-9b7f-2d04df5b8292", "sighting--697d2309-556f-44b4-9345-d02de7f00937", "sighting--b17c79f0-f4dc-45cb-bfb0-35958d300d34", "sighting--b6034e6e-2404-46e0-8a69-eb6792f05a60", "sighting--f629f380-73d6-4422-8022-3ea67756fa0c", "sighting--773fad6a-6726-46db-8e06-70d67730ded4", "sighting--df755aac-f846-4ce9-bc72-d83322523e60", "sighting--94f3fe23-09a5-46c1-8893-c52eb023aa8d", "sighting--052ee2d3-d8a3-4dee-b720-22342bcc2e47", "sighting--6ca71c6b-2405-4912-a0ef-861b5117b71d", "sighting--6595a964-73ce-4332-83ed-009156879618", "sighting--14cafc30-418e-4522-8328-cd9f81c1b5cd", "sighting--384547ec-298c-4e04-99b0-8e8df05e1aec", "sighting--d803c5cb-ac03-4e93-a5e8-6d2759d49177", "sighting--6072694b-30b0-4533-b9f2-8dfaa8b52bb3", "sighting--70bed02f-4156-4784-b112-b7c50fae5ed3", "sighting--fb51b4b4-bf26-4fe9-8d0e-02255b845cf5", "sighting--90852cd1-46a2-4724-a28e-43c266d39f78", "sighting--89cb3032-50c5-436f-a4cc-baa5a1e193be", "sighting--e1066fc5-81c7-4fe3-a8e6-21998bafcea9", "sighting--c4a2912e-a33e-4803-952b-bcb34922baf3", "sighting--79455147-3def-48e1-bcdc-6007e62e13aa", "sighting--41d8366a-5562-4ad4-907c-bd665df76e20", "sighting--b8cb7506-c537-426f-8fe5-705dc98fc802", "sighting--2b988575-cfd0-4c0d-950f-d5b6822dfdb8", "sighting--a6d759ec-363a-46b2-ac8f-c5afcbb4b4e8", "sighting--ae1225e4-6cd8-403b-ba6a-354228ed0724", "sighting--92571ce7-9987-40df-af45-0435511c5797", "sighting--a6a23ba5-3b67-4920-8084-a92ba78f0fd1", "sighting--83ac2d0a-8791-4bb0-94ca-7eb5cbe378ed", "sighting--af8e49f8-ec7c-4461-ae89-c1defd5051dd", "sighting--8d3b06da-4caa-45ba-bfe4-4d27cdc75e5a", "sighting--fda79b7e-5320-4428-b05e-1d0fcfa75957", "sighting--374cb345-228d-4c80-b0b9-973f83065427", "sighting--54f5325b-e611-4ba9-911b-063f62b3df07", "sighting--34a92bd7-02af-4c8e-a13b-ad82cdd9570c", "sighting--9b9ee1a1-8f73-4cfa-83ce-c0d71975bd9a", "sighting--47ae57f8-8435-44ef-9ca6-ff3174e66e3f", "sighting--d00461cf-e80a-442e-8d33-5caf83982cdf", "sighting--881a5f89-a9a1-4887-91e2-e9d26134a2ee", "sighting--1e989cf3-f411-4890-a821-71b168622fc2", "sighting--a711c772-cb7b-46ab-87e0-ba07151808c3", "sighting--04ed3aec-deec-4295-857f-ad6fc1b36ccf", "sighting--6f3d9b5f-853b-4314-ad5e-86c7f2f16227", "sighting--64f5d264-3811-420c-b1d0-afbed3b29d6c", "sighting--799ce60c-28fe-47e7-91bf-603bd33e6ca8", "sighting--445b14f7-b329-4f80-82c9-729c8c5a6182", "sighting--81651e0e-3c4c-4e25-b080-6cb6ae6d0a7f", "sighting--b9e2fd91-7988-4928-9e7f-0c8c2e9d63ea", "sighting--2d4bcfee-1ac0-48cd-b090-1f3a1bbf28d9", "sighting--a8e091d2-9cc5-4761-895f-ceaebc901b09", "sighting--ebb72d26-7c2d-401e-8c51-3795a00b6c3f", "sighting--678c0c7e-4894-4323-b049-386a3f95eda7", "sighting--a8d9cdc8-2903-4e5a-9fd7-2a9d6ec3ec85", "sighting--a98a5152-0593-4a68-8085-814013d21289", "sighting--619963f4-437d-4bea-b5fe-b409156c5f85", "sighting--d34c59ca-866a-4a06-8473-a5968715936d", "sighting--87fe4b31-ca35-4f5e-a21b-7205ccd582c2", "sighting--ac93de02-8ea3-4926-acf7-47b0d01ca52b", "sighting--1e01808c-b9ef-4e7e-9712-175ef2bc8cf7", "sighting--0e5bc2ab-b968-4335-a573-9ac141c8c9ac", "sighting--4d7281d3-6e41-4e4e-9a8b-9ead55b061a1", "sighting--9d173135-646c-4030-93ee-4020bd4add46", "sighting--cf4ac54f-04cb-44ae-bbed-735036148d4b", "sighting--7d741ae3-7238-4b9d-bf5b-17ccd56faf87", "sighting--251d406e-bbb6-41dc-a317-14ac8a3ee797", "sighting--c9c1308d-f949-4396-817e-3f9cc1ea223b", "sighting--0d1762a3-f223-46e6-9031-4b2c07caa039", "sighting--cf2fc28b-96d1-4f31-a218-df3050590dcd", "sighting--28069938-5dff-4935-8707-9640b6fdbd78", "sighting--f4654767-565a-4669-bd57-e63ff6b234a9", "sighting--cacd0e06-82d1-4e2a-a7bd-a37ab2cea1a3", "sighting--d897e07b-3a30-42be-af79-ed2d8e924fd6", "sighting--b86a153a-0031-4fd1-9c42-7fffed37a704", "sighting--303e32d9-04aa-4157-98ac-62c6d2da0618", "sighting--5943cea1-82a6-4749-a1e4-bba881aeaa83", "sighting--1b01e3aa-14db-4fca-bb39-918d62c9ce6c", "sighting--502bb370-f8a8-4c27-bd6d-99aaa888e630", "sighting--08744466-bb25-4755-b99e-c6310cc55677", "sighting--bd08f409-79aa-4e86-9580-f31e0c0ce558", "sighting--471ecca0-4fe3-45e6-bddc-f3d47ae13eec", "sighting--fb1a01b3-1bc7-4b71-8acb-34f5636db36c", "sighting--ed79a9cf-77ea-4792-8c55-9124be13266e", "sighting--22f6136c-c943-496f-8576-55feb03ecd71", "sighting--c4861e9e-afa5-4bce-8ad1-6afb50bed957", "sighting--887ff21a-2131-4205-aea7-1ccf0fe4133f", "sighting--79537b7d-2308-4683-8e25-7b8fdb25704b", "sighting--5f899680-bae0-4af7-a024-faa0b0da1f23", "sighting--9ca3ee05-84ee-4820-abc6-f291df90612e", "sighting--695daba4-9b71-4cb9-992c-6456452fc97d", "sighting--7fab2775-fdc3-438f-9857-4deab9367fa5", "sighting--474c7c0f-f7dd-4877-9210-ddeec74bdefd", "sighting--92d95e41-504f-472e-8371-e0c2b53ae9b2", "sighting--5ae18291-9e4a-4142-91eb-6f9ff0c73fdf", "sighting--3e4294ad-c203-4cdc-bea2-765772a243fa", "sighting--7ec25af9-e24a-47db-a814-2078b6db055c", "sighting--11b0d6e4-7b66-483b-9ccb-0e470cb19c9a", "sighting--1057c1b7-ccfe-41e0-8553-ea308b95101f", "sighting--79915f6f-30d8-4a1a-9746-e01e3681d178", "sighting--e0c0ee3d-ee7b-406b-a5a0-236db7ff2e6a", "sighting--dad4cdc5-da2d-4d93-8b3f-b6119aa2e5f6", "sighting--135c0ed1-668b-4d6e-b427-b739b883e416", "sighting--291b5938-ef5c-4db5-bba3-07e763e5d561", "sighting--3dab078c-18ee-403e-9d31-184374a59afb", "sighting--2412c02f-0e22-42a5-935a-ac032a6f7bb6", "sighting--c5868de6-7a40-4871-851b-7d7bb2d66754", "sighting--e939840a-2d2f-42ff-899f-1e00b3f55dff", "sighting--f4fd60d9-1f8b-48a8-a488-e5e85c6bc587", "sighting--bde84a93-7d5d-43a2-888c-84303d97497a", "sighting--2e6a7c1d-e0a1-4a42-9a88-ae6bf90c7a20", "sighting--66d47c39-602b-413e-8ea8-fb49d09eac4a", "sighting--3748a45c-a1ad-4339-91dd-c268498d4fc8", "sighting--0d7ca4d5-808e-45f2-b974-9a767251b167", "sighting--8a7ccbeb-684e-47c0-aa7f-489d5ed4827b", "sighting--ad96fb40-ab7c-4b92-b579-836ccd33e89c", "sighting--72adc060-6e35-4d71-96f4-33dd4899ccda", "sighting--c2fe69b1-b66e-4203-a04e-bcdb9d9bef2a", "sighting--ae95c1ff-8b8b-44c8-8a1b-4d42f29cd31c", "sighting--cdaa6140-6683-49eb-8434-3220dc3bfa1c", "sighting--6e6153e8-cca7-40cc-b472-ba1035cbefc4", "sighting--73934493-ef2c-4074-89bd-3e770fbaea86", "sighting--c3e976d9-229c-4457-a86a-b1f973c7ff9c", "sighting--e21a9918-24c8-40fa-bad6-60badc27d0cf", "sighting--ef4b53c6-5d45-4248-bb38-6b30e988b172", "sighting--9f5f72e8-1df5-4e29-9840-7a323a713afd", "sighting--dd71785b-13af-40fa-bc45-f013930640b8", "sighting--9aa6c948-124a-4958-b248-15035e7bae77", "sighting--6c8067cc-218a-43fd-816a-417ae66a6526", "sighting--c1fd1f58-eaf2-4f2a-805d-13d9b9e43f11", "sighting--38bb9dc1-feba-4152-bfa8-c9862f322292", "sighting--916b054e-f48e-4fa1-9d4d-c28ea779a22f", "sighting--87a678e6-d9aa-4948-994a-710dc99246ec", "sighting--4622f3b4-55be-46a7-96c0-6d85e84bdf25", "sighting--8f26240c-8436-4847-91db-32519fbd86cb", "sighting--5ff933dc-02f6-429e-9bbd-c7612ff1529c", "sighting--5e8d151a-c9c0-436d-9737-adbdffbcd77d", "sighting--baa4842e-b142-4bb1-88a3-cf13e70e0e29", "sighting--8bea428e-b97f-4497-a81d-3a969f0c7547", "sighting--351ffd24-2795-48f6-b223-b5ae6f29ed6c", "sighting--d7c283de-00a0-4c97-bccc-ace2f4180ec8", "sighting--9fc64ead-eb70-4201-869e-a7ef256730e4", "sighting--4914e690-bc44-48ae-9155-9d1564c59558", "sighting--f843b52e-0d5a-45d0-a750-ca8b6fcf3804", "sighting--2172da74-0e7c-4691-a807-f28e9cb13faa", "sighting--90285798-43d8-4f6e-9012-1a149fd17540", "sighting--04dd029e-8cd6-494b-9210-406f4e70f380", "sighting--5f2d657d-755c-4727-91b4-20d546ba6451", "sighting--08681802-c82e-489b-b519-2002147e2e10", "sighting--2b6cfdc5-2209-4bb1-96c7-e8f479516635", "sighting--aae1f235-a31c-4ae1-9209-33970c11d96c", "sighting--10e06a6f-e94a-4132-9ae8-a3f14e1c6018", "sighting--735800be-7f47-4cfe-a06c-77f420cbf18c", "sighting--c5a5c83d-eb87-4440-aca4-6f14c0986b0a", "sighting--41fbf1c0-e889-46ae-bf8b-b84dd0477364", "sighting--25fc31dc-a546-4878-a824-093d7f0191b7", "sighting--bcbb6fa9-e47c-4581-9003-edecc52d864b", "sighting--46802cbf-fad5-4937-b260-54c485dfa182", "sighting--853471ea-7833-45fc-8189-e7eca6d47a13", "sighting--9ee4ff4f-c7df-4eb4-8b2f-0a2380c3dc10", "sighting--e490af97-14e9-4059-bd9e-1ca902e75663", "sighting--07f32817-df96-4eca-8c45-282bdec92aea", "sighting--ed5ab11d-5f44-415d-8188-abf0085d62d2", "sighting--3fd5257e-8ead-4d27-a468-d7e2c700a2de", "sighting--80206c14-cb67-4dcc-9050-ed883cfdb57e", "sighting--825ba854-1eac-4895-b2a9-9893bc663a69", "sighting--2c68fdb5-d961-4bb0-a4b1-663250f7cada", "sighting--7a53d4d8-db04-4fcc-a4d1-462b787685b9", "sighting--ce4a030a-0329-48b9-9ee2-75cc8509ae2a", "sighting--cdc52414-16e6-4304-85d3-1de53cd3f5f7", "sighting--ee98e8b7-67fe-40fa-8b48-3c958d202d33", "sighting--c08eeec7-03c5-4de4-87ea-bfcac31ad34c", "sighting--c1e48154-cbed-4598-82f0-9b7ce7fd3520", "sighting--77cfd271-4ae9-4f6c-8a22-33f5aca19b15", "sighting--6c0373a5-d085-4c20-b83b-8a0eaf194a84", "sighting--33d4a110-b055-46ec-9e96-29a12619dfe9", "sighting--3c596551-2bce-4b04-bf01-62055a0c222f", "sighting--bbcae85f-44b0-41de-9226-18a063f569dc", "sighting--0b06cb84-2f0c-44ed-b196-5d2481c72dca", "sighting--afe0acef-630c-4c24-abec-5b376577adc8", "sighting--d92b0b9b-da2a-4a12-b738-1ae6ae0f235e", "sighting--81105ecd-a3c1-4fc2-82f0-c86e95770c4a", "sighting--e235cd97-44ec-464b-bc45-967bcc258678", "sighting--c97b981b-b35d-420e-b3af-2b2f356bbebc", "sighting--b8eca728-0925-4760-914c-65ac9cbbc03f", "sighting--6d06b9f0-9bcd-4f30-9fde-5d7e0e7e0dfd", "sighting--5380abd0-a484-422c-9481-451b9fddce95", "sighting--15d7eeb3-953d-4e68-8a0c-74aecfe1b101", "sighting--0bf4fe0e-b894-49c5-b3a9-94d73ed051f5", "sighting--e50626e4-a73b-473c-a991-a372f510a7ff", "sighting--d8f530c9-d926-4752-97f6-66623eb2ec01", "sighting--a33fe497-6ff1-46a4-86e9-c26c8b8ddda8", "sighting--7838a701-6705-427b-a0f6-3ff9b91fa953", "sighting--431af51e-940a-4afb-bc4a-ad80bc52aa03", "sighting--92f1612d-e454-472e-8f02-d85f70c3179e", "sighting--e15047c6-0aaf-4b8d-a2ad-2b6bad0074e1", "sighting--cc842c90-244c-4fd9-bf43-2c5fd2904fba", "sighting--165faa8d-71e5-47e5-aad3-a69945e246f8", "sighting--ae5df633-b666-40b1-9937-917d748a56c2", "sighting--7da3d767-8a0d-4eea-9f20-0ba8015c42a6", "sighting--711572c5-6dc9-4b7b-bedc-50d3f1e5c61a", "sighting--ac049949-7f59-4c11-bdef-f53486ab4ebc", "sighting--cddb8e86-8a07-4512-b5bc-4874fdde3802", "sighting--a1322f2d-6b4c-4d47-b668-b00e1ae29531", "sighting--87d4d4b2-bd8d-4b27-a933-1a9012ba16b7", "sighting--19bc62a2-cd89-411e-a93a-58e8108315bd", "sighting--661778ea-c73d-4dcc-abc1-2567b6a05c4c", "sighting--e421b7eb-302d-4c07-bb52-b3956ceece04", "sighting--bfbd0973-1c45-480c-8c5d-a3771eecb060", "sighting--b6be6ef8-e0b7-470d-a873-e53f62aed624", "sighting--84486078-b3c2-4a4c-8e32-47c2c7c59c04", "sighting--913c87d4-6a00-482b-880b-2a3c7640b7c1", "sighting--90b1c52c-517a-4611-941c-af3af6553c1f", "sighting--840bdf74-7111-41c1-a292-f53aa763112d", "sighting--8eda223a-a24e-4944-8154-aefe701a6888", "sighting--afd0ec70-357b-4be6-9611-5557e6b0296c", "sighting--b932b676-ae66-4a27-b2f3-d4651a662282", "sighting--fd7b4744-c035-481a-aba1-6719d67d1b43", "sighting--ae21892e-d575-4e3b-8e12-6d0500c91cbc", "sighting--e95df434-6415-4b2f-b509-d38e88828ed3", "sighting--cdadb08c-6d7d-48d9-8a1c-f596fa3ba656", "sighting--eb08525e-9293-49ad-9ea9-90cf082f4115", "sighting--caf74b92-87c3-4e7d-a6c3-96c973eaea3f", "sighting--b818a903-2312-4cef-83ee-a5c3086a7875", "sighting--f860ad1c-cc0d-4c8e-bc4e-db5b1a9f9e06", "sighting--457a0299-fcd7-4b21-8b53-0f5db3869cfa", "sighting--2cc7547b-9c43-4a1d-87a2-1d7f43c8c053", "sighting--4f1a745b-936b-4878-99a5-c7e5310e1c56", "sighting--ed31c581-40c3-47c1-bad6-d3d2bd429448", "sighting--62b54d71-832b-4390-917f-8ec024aae2b9", "sighting--ddefa77f-9109-46e3-8183-6dff254b3888", "sighting--c1addee4-1893-4dff-94b7-2f5bd613adec", "sighting--2100f201-b895-4a6f-9cf1-465218632b09", "sighting--0c5ad32e-dd80-421c-93be-acc09b71d563", "sighting--9f65b018-2a1f-4eb8-90dd-2b47f96b99a5", "sighting--1be6b41d-82b8-49ce-a9b0-f0dd47749d87", "sighting--fc716195-8d67-4474-88a3-b1fb8e16c397", "sighting--5ba5e0b5-2fd9-4f13-abdd-301783e14b1c", "sighting--4c91eba9-f4bb-4b4c-a65b-301299e8050f", "sighting--36ea7279-82c9-44f4-be93-290af24ace8c", "sighting--65520d51-7710-4e3a-ae85-34823b2074d4", "sighting--c57c01c2-dc43-44ab-b34e-df53170b4dc7", "sighting--e4ad3ca8-7081-473d-89fd-83b5eb029b41", "sighting--c11e89dc-f7ee-4036-b28a-9fab2dff8508", "sighting--6ab07e7d-7700-4245-b9b8-caea874800e2", "sighting--8a375bd2-69de-4472-b905-3c178a2c5f4e", "sighting--f49eaad6-f246-45e4-8274-5cba6b02d47c", "sighting--4e173a0b-5134-423a-96ea-1ab5c4235c78", "sighting--92d74e33-9382-403d-becb-f9fd16b28bec", "sighting--ab0f5d65-c907-4033-a794-7811c79fc152", "sighting--8b6fa96a-e4d3-453d-babe-6751f5b01de2", "sighting--a4a318c6-82f8-4436-831e-dc3be109acee", "sighting--d3a7c7f6-34cb-4bea-a7ec-02b8081f06bc", "sighting--6eafd4d7-09cf-4a2e-9895-685e7f0748d9", "sighting--99f3bf10-acfa-4b34-aa1b-6b70806c1ca6", "sighting--bd611ea7-51d5-4af9-a37e-199ecc157c7b", "sighting--068655b0-a107-4d1c-9a24-05b698edd626", "sighting--2a9e9d39-36e6-49fb-95c7-474decfe125c", "sighting--7317cbab-24d6-4756-b8e0-f80639722a3c", "sighting--7e8ee880-ff9d-42ef-a304-805c0206a445", "sighting--9fd8acca-69a7-4db5-bb7f-798bfd36f50c", "sighting--c193db2d-4c41-4fae-a41a-cac0bc3dbbc7", "sighting--c7f13e97-4cab-4e21-9123-6c677330eba8", "sighting--7ae9b9ae-5f4b-4d89-9113-647882668f63", "sighting--68d4fc9e-13cb-4817-b5f0-f3855bce529c", "sighting--29423582-5e3c-45bb-bd67-90311297fdc9", "sighting--0acf5745-1808-47a1-8ab1-b596e70f40d9", "sighting--f195f9bf-a30d-4c6e-991f-ae4a54d3a90f", "sighting--67f9276a-a989-407a-8027-b3c6d61d9b88", "sighting--332c23c0-81fd-4cd5-8810-7f58753b93ad", "sighting--f3443a7c-b96d-454b-99b7-a6846649b046", "sighting--ec6adcac-77dc-4367-a8d1-ca267f88c092", "sighting--00a0a014-0851-4d9a-b96b-38e943601a78", "sighting--451a9261-b2cd-48a6-846b-f15795fc6c84", "sighting--e0ca94dc-9b75-4c65-baa9-a326f4032c05", "sighting--82b0e60b-964c-4cb4-a5c2-1abb6b2e2f4f", "sighting--fbaa21ec-b538-4975-a6a9-186f0de2e6a4", "sighting--74bd6f05-0fe9-471d-b0cf-dddec2222812", "sighting--1ec844d4-e29d-47a5-a51f-79340fe88edd", "sighting--3ffa1a9c-469c-4d31-9043-d5dc6bc05537", "sighting--85272925-7147-4fb0-9c8a-07a281a85c48", "sighting--9af5c40e-09bf-4704-b23e-85d323ab57f3", "sighting--60076718-0546-43ae-b4dc-d90b08f3a776", "sighting--928f3479-8329-4073-a144-411f829820da", "sighting--67e5eed4-e08c-4667-8a37-c7f1808abd78", "sighting--c1994fe6-ac46-4669-9058-b231c9a32987", "sighting--1e18ab3e-3693-4b0c-9881-3219a83297a5", "sighting--4ae13a3e-4560-4965-88b6-03f896789853", "sighting--0a3817b6-312b-4fa0-b62e-8cd4d6749fe4", "sighting--8cb9532a-777c-4ac3-b54f-805146d09943", "sighting--491a2fed-ba8c-4291-bc92-f8d3bae32acf", "sighting--1af6daa5-0496-4501-8d73-a8b07e89599e", "sighting--e098c5da-c394-4d74-827d-439028f07103", "sighting--e2ce51e2-7ddc-41a4-9252-59a9bd17152e", "sighting--ede4a3dc-3b34-4752-9acf-5a7df0f693f3", "sighting--4a8c8b8e-68f3-41cd-8c6d-57b863a081d6", "sighting--674b2c31-018f-484d-b055-313b7cb317cd", "sighting--fe048ba2-e402-4422-9a72-89dd19932d0c", "sighting--7842ee81-e09e-44e7-ac23-816e2f5149b2", "sighting--f8f6b0d4-96f8-4e04-b992-1b4a23aa471a", "sighting--65378c0c-51da-45f7-9b1e-179a737c44fe", "sighting--b5b3834e-918d-49a5-a531-fb1f93a5498d", "sighting--124ee45c-3ad4-4574-970e-fe9a2e1948e8", "sighting--56cd91d5-d50c-4a5f-8bed-c95de132a37c", "sighting--70425e68-8495-485c-8fec-3ec424616072", "sighting--d76c68de-7904-492b-b137-c80cbb407b2e", "sighting--de1aecae-b3a6-4be3-a1b1-f4ea77e30c40", "sighting--fe3d23f8-07cf-4e7a-8cf7-4734fb49665c", "sighting--e5820d2f-83c7-45f6-a65d-2078ccce0f61", "sighting--6c4b7979-7a34-4a4d-8c40-bacdf7abc146", "sighting--ae3ab137-314d-496a-afd9-32f254b9a9be", "sighting--5a5604f7-80de-40e8-9150-559db46dbbc9", "sighting--5b061447-b75d-41a9-98c1-7c54b83d61d0", "sighting--90ba125a-43e0-4c26-a91a-4fa09ca58b41", "sighting--0bab4bfd-f047-45f4-80b6-90c683d61197", "sighting--fbffaae7-99ab-4393-8a49-ded4d5a9d4c9", "sighting--692b0455-5a39-466c-ba95-28b3b6b4a2f1", "sighting--38bae886-475a-4efe-ae0f-2aaaf8e20085", "sighting--904bd66c-75f9-441e-b214-2a4dc478270c", "sighting--c2c2e28c-0386-41ec-a1e3-e0c7fc0ea8e6", "sighting--f88c4a0c-4a9d-4da9-a2da-cf3aaa6861dd", "sighting--3198f70b-fbc4-403a-bd4e-422fe4c579d6", "sighting--e3e5bc85-f904-4e93-86dd-06107f9ec053", "sighting--d7c28731-7364-4f82-b5e2-8333fda9df8b", "sighting--14fc7ea8-635f-4475-aa8b-4766e29ce970", "sighting--720703eb-ec77-4067-a4d6-dd9fe1710643", "sighting--510926e3-52fb-4f94-ab97-670a50df783d", "sighting--bc627f11-8d72-4e8b-be37-d731e0301b9d", "sighting--a8e11229-f0c3-4336-8967-8075927369ce", "sighting--f4a5bfb5-c4b3-4a43-b505-438b6b7efa04", "sighting--cdd2d55c-b9e3-4afa-990b-fce5c69ecce7", "sighting--2b745fed-e99c-4f90-9b6e-9dd4a58e15c2", "sighting--9adf3513-b361-4083-8b90-50bd3745dcfd", "sighting--25769be5-62f2-4e13-9713-a96c1cbd5f3a", "sighting--130d2c26-4ada-460d-99f6-01d1e645ae83", "sighting--ded91e01-d963-4af0-a2fb-54ec2bd89881", "sighting--0bc415ea-4a26-4ced-8505-a682ac85e862", "sighting--85405aa1-becc-49eb-b722-3765a3b4a0bd", "sighting--d08d9291-e9d7-4daf-b01e-893f5f6a7fd0", "sighting--230c6a72-899b-4d2c-b699-17db7e52606d", "sighting--114f240b-00ff-4082-adc9-ac763d905c36", "sighting--9bc43fae-cb16-47bd-92bd-071e997b78f9", "sighting--9547afd7-e4fb-4131-b078-4b1d1e3eeba4", "sighting--925d04b5-90c3-42e6-a015-5d6a20c508f8", "sighting--39c52e69-a011-40c4-9135-b36ebeff27cc", "sighting--ac2a9ad8-8915-4fd0-9067-722f468d1f28", "sighting--66a00a6d-0fa0-4e21-bf08-08cf94cf01e8", "sighting--a6a1283d-3912-41e6-9f79-fb78e7040af4", "sighting--342644ec-5f54-4a16-a986-0862db4c97f8", "sighting--af8cc755-8750-4304-84ae-2e1d1da87ce1", "sighting--f5adc714-269e-4835-ba81-00e0113aba46", "sighting--f0236be1-b75f-4f9f-8c84-53944c8f4fa1", "sighting--8abc07f8-181e-4556-b6e5-35d428b7a64e", "sighting--5d7647aa-dd62-4d64-801a-f3776bffa835", "sighting--046d9892-f362-4b63-baa7-29a4fb5608d2", "sighting--0b91de2d-c82d-4024-abd7-a2b64c1cdd21", "sighting--40f07157-2ab7-46c2-a2da-af5398a04859", "sighting--c14d74b0-c6a5-4e9c-ad0d-41af4335d678", "sighting--4767df41-fbb7-4b22-8d2a-79ad4d6d81e2", "sighting--ef24c68e-529f-4c5e-b24d-60b6754ef45c", "sighting--5263b478-9ecd-4628-84fb-feb86692d6cd", "sighting--11d1bebb-4987-47b6-ae8e-f02571700f6d", "sighting--1b0464b0-f31f-4a0b-a756-2bd392d13872", "sighting--9696d2d1-0977-4309-b2d6-f14ebb0d3b23", "sighting--8a62b5bb-4c1e-406c-9c4e-1aa8fba6cf70", "sighting--800ce377-f65d-4297-9adb-e964ec40d4f9", "sighting--987a8779-c987-481c-af77-04d850bdccbb", "sighting--7ebd97e8-367e-45a3-b21e-a2ace0dfbd2b", "sighting--4203db67-8d65-438d-af15-d1ef9561d735", "sighting--2a9f2bb6-e1f0-4dd5-852f-b0548f11720f", "sighting--c06c8990-77d7-43f9-9844-4cb181bf1e5e", "sighting--5b20b3de-c226-4697-afa4-3045de06902a", "sighting--2a77b815-4d43-42ff-bd39-f898576c14ac", "sighting--b6f40320-ac90-4ef9-9ca6-f0ca65a17558", "sighting--a780c298-1170-4f4e-80a8-779542e7abf8", "sighting--4dfcf1fd-f2db-4b94-b7ce-3b5d7b9d80a4", "sighting--f408620c-a847-40bb-9409-383753ac76e7", "sighting--ad8c7602-772b-4350-a316-b8670238da5f", "sighting--b5996cad-31d8-4dd0-88e6-6b14326d5e12", "sighting--f2453259-4086-4576-981f-b8a9cbd342d3", "sighting--e8a1afe4-24bb-4016-bac0-07203534eb66", "sighting--37981495-e18f-452f-87d6-a2ce229d8e96", "sighting--8bb88160-cd44-4555-9cf4-c59f36edb89b", "sighting--bcdf3e09-e6e0-4529-8200-7156ca969414", "sighting--af3aad21-af2e-44e3-8bf1-f9ed5a13fa0e", "sighting--a93cc00c-f502-404d-b27e-ad3033add1c9", "sighting--2e8a4901-f847-4f42-be1b-8b51a7427120", "sighting--6222d74d-1b07-4682-ba02-95eb0e6bd89a", "sighting--fe3b861e-68d5-4a24-8278-0ea505a951ee", "sighting--0768b0fc-e4e4-4e85-ab99-839322728eaf", "sighting--86e73f47-3428-48de-8739-80417c31801c", "sighting--b7ca6a14-5d78-4c4a-9776-1dfb8c7c323d", "sighting--bbea01ea-ca67-41f9-b30c-dbf8e2ec8bf2", "sighting--fbec4e1c-034e-4a04-a596-0417c1cce2ae", "sighting--daf3c5a6-958d-456e-9496-feb84ac9e87a", "sighting--580a7021-e2a9-4b21-8aa8-e7387bc442d2", "sighting--96c1caea-2e80-49d3-ae94-c726d2a4647c", "sighting--9b038b9d-77f6-4c81-957d-7d59686f3194", "sighting--aa7e7e4a-13c6-4208-8433-74fe6f4791d0", "sighting--e1c16974-3ac9-46fe-ac3a-ee13815462e3", "sighting--590c8d3f-8dd6-4850-a33d-9eda910de561", "sighting--97dd5817-5539-47e9-9244-7c69c7286d00", "sighting--a84a0958-c0a3-4d96-a3f5-4395d06a0307", "sighting--a927cf02-f060-40d8-be97-5c14e228c64e", "sighting--3f30199c-b904-4b95-b131-80b628ba148f", "sighting--e4f116b4-7619-4921-845e-efed7d669c2a", "sighting--ea6154dd-ac03-4bc7-ae29-880b12cafe8e", "sighting--e0933e95-51f6-4e59-8677-fcc5d50ee12f", "sighting--8b64d34b-db2c-4935-84ab-e1045d7ff567", "sighting--f38b26b5-f34d-4f0b-8ccb-82ea2886b2ca", "sighting--cc208455-b362-4ea5-80a9-ed0700183f4e", "sighting--2bc29ad0-3925-42aa-a9ba-b2151f7a165b", "sighting--4bf3baa4-5933-4e6b-bd20-119c190dc830", "sighting--dedbc30a-7233-41a7-888c-15de985d9add", "sighting--9bbc2ec8-9f2d-426c-8e4a-7f90b140f7c4", "sighting--140d997d-9e56-48ad-877a-3460222fdf23", "sighting--fc05dec1-707e-4318-ac36-64baa15c0586", "sighting--5fd95e8f-48d8-456a-90a5-fe88ae2a0ad8", "sighting--bb3ce293-6a88-4b9a-8588-b098a27d3a8a", "sighting--dc6e5019-9469-41d3-afba-f7c4f9ffe5ed", "sighting--0728c180-afed-4cf6-b0c8-03d17a234116", "sighting--8821f286-bcbb-415a-bdab-2bb19250524e", "sighting--787346f2-1b9c-4306-a551-89cdd76d01c4", "sighting--33aa0529-ea4c-4524-ae2d-389d8d6a195b", "sighting--d0a96daa-8b1f-4e22-9fad-688ba551a9db", "sighting--5efb95a1-3302-46bc-8636-b6da1170e31e", "sighting--1c193409-de79-441f-9bd2-812e90acfac1", "sighting--b48f74df-6439-4ffa-a04e-6dd305e11ba4", "sighting--2206f2a7-a50c-4b84-aced-68a04a0fc6a9", "sighting--5a827722-2e1b-4c11-925b-2200b819b86c", "sighting--92edb2e2-8b66-4f0c-bd99-1c934cf714db", "sighting--a5c01cec-3324-43a1-a509-8ffd01ea3e14", "sighting--c94639c1-ef4b-4904-bfea-cef8eac695c6", "sighting--5e5df2b9-c003-463e-a309-533eecd864f7", "sighting--375daa49-b7b4-45c0-bf02-8bfdcf048b0e", "sighting--247e56db-7a61-4b27-9d54-5e54af10383b", "sighting--b6578126-3a79-4e6e-a6be-45afea840b9d", "sighting--82cef4f8-edf1-419d-b389-ff5d46a67976", "sighting--cf2fc2c4-4d6c-4910-88b8-2300ba03d4fa", "sighting--6218e79a-9d7c-4555-ac73-a1a53ee11e5a", "sighting--fbe44f94-e73d-4008-88c2-cafb717ce783", "sighting--3d9be884-70f7-4b06-acad-f7fa6892491a", "sighting--1e2b2d96-f37a-4e06-8c24-5500d9e4f370", "sighting--79e1d316-705f-4caa-b021-726e8773f440", "sighting--322c541b-53e5-4c4c-86b4-c49af29379ad", "sighting--c3e69c07-fede-443b-8374-8524ddf78565", "sighting--08555995-69d8-43f7-8acf-7d11bfcd684a", "sighting--61c4ccbc-41c5-4cf1-8eeb-3dcb7d336934", "sighting--6ab52dba-a0ac-43fb-be71-e41ce49b7a5c", "sighting--4cb09084-d0b2-4957-9062-622b3c283b0b", "sighting--6d42173d-a049-4be1-9248-8189c37da44b", "sighting--e7ec8900-23ad-4d17-9d1d-d1fee5ff71cd", "sighting--2cd44534-dc6d-4040-82e3-418e8aa1650a", "sighting--c3d2303c-daf6-4bfe-94da-1c97e544a01a", "sighting--129e1f95-dcd8-4b57-837f-0a044cfa4d03", "sighting--5d81f540-a6da-48f6-9a95-70558cb9b1f4", "sighting--a315c4c2-a674-4431-8b1b-f6edc7165b53", "sighting--e7ff5d3a-8303-460a-ad79-f925d2110e9b", "sighting--757f0ea9-cb05-40cb-bcf8-a627f9cb4ba0", "sighting--81d29a3d-ec70-473f-a567-b2fa185dee28", "sighting--43684936-2188-4798-bd5f-16fda25be533", "sighting--37aac67d-67c4-40b9-80d0-32667bb80aca", "sighting--839e11ff-6c73-4134-8035-de4d3370eaba", "sighting--53601788-1cfc-4fb8-95bd-bbce97386ff0", "sighting--119591a4-e14a-4f4b-8327-bdb662cf21f6", "sighting--31561525-cdd8-4dd8-bd99-b3fe486a739f", "sighting--79d43b08-1ca7-4ae9-b9b8-e0fecf46b9b3", "sighting--d148afa5-5290-4c05-afb5-0c4b702c4309", "sighting--adb58c3f-b004-477b-a913-e27882f6bb2a", "sighting--0ff09aa1-822c-415e-a706-827488e782d7", "sighting--3323f3e0-4713-4ba2-8023-61d001bb73c8", "sighting--58b20591-1ffd-40de-8cbf-ee6adf965bf2", "sighting--5d9e1cf5-5dc5-4ac2-8e92-a3badf88594f", "sighting--75a25f0f-1feb-4014-957e-3f658d19ba4f", "sighting--d03f9423-ff16-4440-8a1e-366e112886af", "sighting--3af91522-619b-4ad8-aa8a-59a6c9f1c726", "sighting--ce314f13-8fce-43de-9037-970e92c494ab", "sighting--ee02d2a5-43be-4d09-bf51-4fab2943064f", "sighting--e71904a2-7572-48a8-8294-84fde9d148a8", "sighting--b28af445-40af-4a3a-b3b7-f59363539ee6", "sighting--269c1c40-6ddd-4611-b0c5-b7bc4dde8627", "sighting--8c543dc3-1397-4bd5-9d0a-2d6a60449c08", "sighting--02b1a5d4-53c4-4f2a-ae0d-37b93d9a7d79", "sighting--f8749cb0-04aa-4248-b25b-008c98b368a3", "sighting--a92b57c2-47f9-4175-a972-4003e0d50ba6", "sighting--5ac3c970-0c88-4734-b7c4-490003dcdb9b", "sighting--e12b3bf9-fda6-4676-aa2a-988587823da6", "sighting--dc2eeb6b-4af4-489a-b4c0-aef8f314072a", "sighting--56d75b4b-cf27-4b27-a57a-9301af0bce91", "sighting--b18426f0-fdb1-4476-89b2-7a0daca16401", "sighting--74154d13-bd6f-4875-8a12-07eaccfce910", "sighting--7f6a9594-c2e8-4d77-89d2-349b78198b65", "sighting--e1398d95-8254-4a7f-b4e3-187b610dd893", "sighting--e9ac5ebb-032f-4356-8125-f335e7a7497b", "sighting--b75c54ec-70f7-4d66-aad4-5a5896b12779", "sighting--a4aac345-3d51-48f5-bcd8-b247d5e96e7c", "sighting--4865f47b-7c2b-4e79-a81a-7fcf631dfff5", "sighting--19900b6d-5d4f-461e-a326-cce4e9437fb9", "sighting--94df0196-0e9b-47cf-a203-1599e3a97a9f", "sighting--cf7eadae-70d3-4d46-b7f6-1443e903e3fe", "sighting--5cf52450-a0db-482f-8f6f-dc49a8b4cc10", "sighting--a9d46527-7632-40a8-a72f-3bfdd12a0025", "sighting--5e08655e-f579-412c-89e3-03a303fed444", "sighting--3761814c-7f34-401e-8eeb-5f3c492988ab", "sighting--ce692abb-9e82-4ba9-8cf4-0cde36a2e53c", "sighting--b5a350fe-c3a9-446e-ac9c-b0f092724efd", "sighting--8796e2fa-00d7-4317-95e2-b0a57beefd11", "sighting--0ffab4d2-ad7e-496e-a233-4e18720e12ff", "sighting--d8242a79-a1de-41e4-b694-6e1a61eb3865", "sighting--8665da34-b995-4561-b4f3-87a1bad7bc1e", "sighting--e6dc59d5-adec-4a9f-aa2e-ac86e6976470", "sighting--32f6702d-f20b-4159-982c-c0a4059a3b13", "sighting--d2cd9385-2cd8-43c1-b88e-96c6bc6a76b0", "sighting--4997fcb3-897e-4ffd-8c63-ebf5f2c8c146", "sighting--db8f38c4-7b01-4842-b472-8ccf0d69f8d5", "sighting--f8032684-4f67-443b-9e3a-cdf50c6c7f6e", "sighting--088bd919-3853-4dbd-83e5-e515d8632c88", "sighting--7f06f636-b30c-4d44-9a4c-e593cc59b954", "sighting--b0d7daad-a1bb-4bbc-85a7-426db2c4ff87", "sighting--545d03f0-b842-4008-8255-6c513b7eaee6", "sighting--b00844e1-d467-4bd5-a171-67beb0a768d5", "sighting--866116bf-0408-40fe-840c-af0021cc700e", "sighting--b4999642-e1e4-4bbb-937f-a686d27ad028", "sighting--7c51988f-2b10-452d-b376-4412c15bdb9a", "sighting--b8461966-bd07-4296-a700-e19fb8dd6cdb", "sighting--b76267fa-5c7c-4b9b-8a0f-4a14e00418e4", "sighting--ca037d2d-8a78-4810-8304-1635c9c844f4", "sighting--edf8c19a-a368-4ff6-b2c4-38297437904d", "sighting--172e9f94-3328-4d98-a843-f2ec21c030b7", "sighting--bdcb4992-f27f-4876-92c7-6496192f629b", "sighting--587c6a94-2d77-4170-8f37-df15514a3b3d", "sighting--fbbe5d0e-89ef-4972-8152-99a532c15d3f", "sighting--c1c33b39-b24c-4de2-9f3c-ab0e7710de2b", "sighting--0afaf4c8-3bd1-464f-883a-80ea5b54374e", "sighting--4d13da36-e40f-43d9-91c6-8d7422f0e3cd", "sighting--687985b4-0bed-455c-8d19-3ce3fa7bfd49", "sighting--4a6d193b-5e02-4842-b2e9-5f6dfdc1caa9", "sighting--526e1f77-f6a5-494c-8473-4036652851de", "sighting--c53a68b0-b92d-499b-a9c1-2000d1fa1dfe", "sighting--8b9ef93e-9958-44c6-84bc-0a65d9d29cfc", "sighting--eb205dbc-1cf7-4030-b0f8-d362603054e9", "sighting--f2ec2723-26ec-403e-93ce-cf598bb6b8f9", "sighting--88fe0c2c-c893-4f69-8461-5a7164b911c7", "sighting--6d3eb705-76ea-4f56-8b25-213984598136", "sighting--6e9dcb84-88cb-4ebe-b36f-bddb5a0de4de", "sighting--33c3b3b5-d26f-4b27-a733-641d3972a564", "sighting--a4d6bac1-17e2-450c-af28-4c0d532e96e8", "sighting--3bdfb298-eda4-4b55-937a-60864e9dd471", "sighting--d9973715-75ce-4255-9099-fabc27c90a79", "sighting--e2b30bbb-860c-494b-b65c-fbe962f7d274", "sighting--a59f2b56-ae0b-46ad-8012-ab2e43476920", "sighting--1b368e1a-663a-4201-ad76-553187b7d918", "sighting--5686eb75-6809-4dd2-b24a-e1ab04bc7593", "sighting--adb30167-a40a-431f-8bf3-81792e434f26", "sighting--2cd7ff55-e85d-4303-86fd-0293e5e7c231", "sighting--eaa305b4-c4f6-481e-848a-b7e224b7fb75", "sighting--8dfe44ce-0948-4c0b-9eba-3728ec6abd47", "sighting--4d7283c9-4057-430a-92e5-f214748d7367", "sighting--289c5a96-e79d-43df-9fc7-9db24110f892", "sighting--58e2af49-d9e4-4807-9d5b-be431b050163", "sighting--ac40b7d9-547f-4e0b-9497-4a556c67041b", "sighting--50f2032e-2bbd-4aac-bee2-e1f5637e7bf4", "sighting--2a137cd4-5d28-41b8-b4f8-cfda0fd3b1b2", "sighting--e047055e-766f-47aa-ac47-83e024a40960", "sighting--bd305e79-918b-4384-8652-f20de562295e", "sighting--019e7827-dc68-4896-9e3e-9f75ecd26688", "sighting--c459117c-f64f-4c9b-980e-692290f7db6a", "sighting--a81edf8c-2d95-4523-9070-b2f3e676bf16", "sighting--f2f59203-0a9d-4683-a8fc-564d8a6c757d", "sighting--1aac7fc7-1bbd-4086-a726-849abf3c2b97", "sighting--103a9413-74fe-41cd-8793-85762205ca3f", "sighting--24e2e5ae-2423-4362-a48e-e3003f19e0a3", "sighting--87a61464-59e5-45b8-bbb5-7e8e6caa6a07", "sighting--bb1aec8f-f365-4ba6-8ac7-b53ddb37abec", "sighting--2f81bcde-c28b-4e59-ae0a-f87fc1348e48", "sighting--072b1580-692c-491c-bc96-06ec6d74545a", "sighting--0e769ab5-86af-4b97-880e-e11b6a2895d5", "sighting--4733055f-cdd0-4e95-9ad6-800e328dc856", "sighting--c46d2247-7149-4c76-afbd-efd164983a3b", "sighting--da0f47f2-1e44-40cd-8eb1-4cf8ef2e8b18", "sighting--6abc0191-c671-40d0-8bc7-5175eb712630", "sighting--d3d518a9-ebd2-4c65-bafc-3ce1d13c55bd", "sighting--2273c359-8127-4ea1-8d49-ec7acd0083e1", "sighting--51d00981-21fd-4341-9961-f698a0bb712d", "sighting--049fc25d-e577-4f14-ace4-c733c3cd8ccd", "sighting--1f21be00-a82a-4569-b729-5f134b1596f9", "sighting--9bb608ae-7db8-46e0-b187-d0939b6c76cd", "sighting--2cb57d91-f348-4706-867b-4575497c01e5", "sighting--15ad160f-e726-41b8-a622-4544cbcad3b7", "sighting--53086206-e7ed-4f92-9a1a-96072b598fe0", "sighting--0ce1f480-1069-415a-805b-7ce45cd965b0", "sighting--659fd6c3-e8c7-4c57-8c7c-302635c84bea", "sighting--dc0b62a9-24ec-4226-bf24-35582ff0a2a3", "sighting--6d70be96-d32c-4d41-a1d4-59d6c22702ae", "sighting--a03b694b-6324-4073-b22b-f536c4a43f71", "sighting--4d3a734e-a6f3-4f9c-ae11-9f2e7aa01d94", "sighting--28a606a8-e0bd-43bc-a06c-f4029f9f3969", "sighting--0c634e62-9559-4259-b2f6-93407ff8921d", "sighting--3eff5449-0c4f-4872-8b6a-7738d4d40baa", "sighting--f7a57e7a-4fcc-4b8e-a190-b8153f68e9ac", "sighting--0595a805-e047-4643-9026-b2f02e218f46", "sighting--f46c77b1-42c0-47b3-99b0-51692108ce53", "sighting--7ff3d393-22da-4efd-93fb-9f4b19795da2", "sighting--426204a9-871e-470d-9cee-f562fbfc7b7e", "sighting--efdacd1f-9d3c-4525-815d-18540a81b093", "sighting--ddc9d560-3832-4fc2-ae13-8c0047d0e325", "sighting--0c5dc942-68d7-46a5-8c35-438286537199", "sighting--c4afe8e2-68a4-444b-a4cf-ab951e38f523", "sighting--1bb044a1-08d5-4e3e-8f78-87a354222ffd", "sighting--ef29222c-04b4-4938-be13-ece0bc127a5e", "sighting--3094d827-c76e-4b10-970f-ac8a5bb722eb", "sighting--03be8bda-7135-4566-bc25-bb4512f7999a", "sighting--6b679920-c414-4232-bf19-a11b0970b8cd", "sighting--68d2c4fc-4837-44e4-a2ee-02074cdfba7d", "sighting--8ea6cf5f-670d-4002-9ffd-feb4799f8217", "sighting--15a31a41-640a-4836-b32f-71e6fec269c7", "sighting--d63381f7-ae91-4da2-ba23-1b01e2a37dba", "sighting--cdc31305-cb4e-405b-8c4d-126ed9f7f776", "sighting--325d0a01-cfa1-48a2-9601-8d0f882629d2", "sighting--4a7a0c45-aef3-4068-9d8d-6fe65f16a96e", "sighting--29f871d3-ce9d-4000-a561-1e465461eeaf", "sighting--b7b93408-3369-4164-9de0-05333065c726", "sighting--24c6e306-5289-43ef-9481-c6253d0421d3", "sighting--9ad4e033-a6d8-4cd5-855f-3e2f5482d923", "sighting--b6a0ff8a-9b60-4142-9a63-b331f081f11b", "sighting--cf9e4406-48e6-4859-8333-dd8316bb2c30", "sighting--ca5791a2-228e-40a3-8364-9e209ddd7239", "sighting--2d209ca4-32bf-4397-9995-1b3cb9a693a3", "sighting--6b163f20-3552-4b7a-b2f8-dec6b30568f2", "sighting--11946d4d-5606-43f7-87f3-f061a27ad33d", "sighting--1515bb3a-9921-4caf-b17d-0b74caf70dc5", "sighting--237d0d44-5594-49bc-a588-7bedb3dded38", "sighting--7b53b54e-0d52-4be4-b730-042cb856a3ee", "sighting--07eff205-26e2-4ae4-a82b-1b5cb8076db5", "sighting--50708716-d138-4a05-ab56-353ec8aea31f", "sighting--dc7afd13-8ff1-45eb-9a92-3a0859cf0d8b", "sighting--25caa179-f4f3-434d-af9e-a4f1423db4c8", "sighting--f43f92a0-69df-4c6a-82bf-2d3797512863", "sighting--447cb555-4a67-493d-9b64-e1a143d3f02a", "sighting--e11e174d-d8b3-4a47-8212-7f600852789d", "sighting--d2fbea47-0246-44ae-8f6e-6846573dfbe1", "sighting--e18c8b2a-d30b-4023-983f-5981c42c41fb", "sighting--89f115a7-69c0-435d-82eb-c8d2664ac1d2", "sighting--2e12f39c-fe1d-4cfc-93f0-4f038c277656", "sighting--b22c7ac0-1ed7-4d52-83ae-7b72d6c446cd", "sighting--22845602-e07a-4483-aa3c-a57b7bc992c0", "sighting--b335fde9-cb94-4594-92b6-710625608c29", "sighting--6a96e7ed-a1f6-4586-b9bf-ac075db7358f", "sighting--b37c5dd3-1648-47e7-bb7f-a0b9192d9aee", "sighting--8085c667-e83d-4953-afab-216a9f9feb40", "sighting--f894e818-11cc-4c69-9afc-0076a3b1838d", "sighting--1f49d4fb-3e07-4f19-b8bc-19b35bf197a9", "sighting--85bdb63a-b817-4e71-9174-02151a807c4e", "sighting--7b023930-42f7-4ba7-9e51-a4abec05b836", "sighting--98c02d99-d296-4d5a-9379-4fc46079720c", "sighting--a2c7a692-f2f8-48db-a9dd-d9175c149fc1", "sighting--c22f5e30-0269-4963-b34c-a45cf4c373d5", "sighting--a5c84f87-771c-4e62-b4ac-5e03413fbbee", "sighting--4f16773b-e367-4900-a565-900586c79ef3", "sighting--80a42eff-312b-4496-a9f5-70c1158200e8", "sighting--55aa8fa9-e445-4093-89ea-160419536765", "sighting--c5ec865a-9f45-46e5-97d7-709453680020", "sighting--ded13cee-66e5-4a42-9142-80fcca329c55", "sighting--5f54fe4e-4530-41c4-8377-b7e2f0c6e509", "sighting--bdc60138-e9b1-444a-b146-f07bdd32e5ea", "sighting--abbb27fe-fd93-42a8-aedb-ce3a77f0e64c", "sighting--9fb9a5b7-0496-40f9-afd7-887069e4f24f", "sighting--8e61e338-ee06-4ddd-8168-0c2c7ec39471", "sighting--60414f03-3e33-4e77-9054-85cbc2b4b979", "sighting--4621ac4c-0c26-49a0-bdb8-c49e50b9783d", "sighting--0cacb61f-4ff8-4405-9c3a-509bddcf6545", "sighting--3749c6eb-06c3-4a2d-bbc4-fe5c5a0f4f85", "sighting--b3d8b21b-eb7d-4678-9549-06fa13af39af", "sighting--2810e62e-57c2-4c55-90be-740a622b4c45", "sighting--2f3a9201-d8fc-40c4-beee-aad8d4de1706", "sighting--65b122f8-5106-4367-9fca-52f87255552f", "sighting--5cc44902-71e8-4f34-9a01-5654b9a0c071", "sighting--bda3a880-5bc0-49fe-8a46-ab47b121d0f2", "sighting--b91d46bf-0be6-466c-a6a8-c98b8e91ab71", "sighting--71ef8ffd-8cd8-41a7-bed2-100ffa89bc6f", "sighting--60d4502b-f56a-4905-9f67-1f8e3b847958", "sighting--c80df7ac-e5c0-44d5-9c60-a3f0fdf4034c", "sighting--a8b1733a-e874-4380-b5f9-5f69e6c91968", "sighting--afab480e-fac7-4b18-9bd9-fe95a6377f51", "sighting--5fb428bb-55f5-448e-af9a-95e5565604db", "sighting--515dd5b1-0728-4b90-b772-2c33c2d5e713", "sighting--c8eca76e-35de-4696-8284-cf63f017a018", "sighting--722a2103-fe94-450e-97f1-d69971e53a1b", "sighting--7f1f3031-bfa4-48ac-970c-63c3151a292d", "sighting--0a8bcb4d-3614-4f06-a8cd-f8699ebf0b3b", "sighting--21b200e8-9fe1-4545-a61c-56927040aa32", "sighting--3f3d6fe9-9925-4aa6-afdc-023487f990ae", "sighting--8de88750-d48c-4d75-8651-4e0a3dba47de", "sighting--4fd68d57-191d-4933-b51f-28c0282db7a1", "sighting--1a05cde6-7f07-48fe-a062-fc788ffd8ec6", "sighting--688ba1d6-031d-48e6-88d8-f68f81e762c9", "sighting--7e434206-9549-407b-9c06-333fd4ca0022", "sighting--e05d2ee5-0cb1-44a6-8a85-2c373d07f600", "sighting--a5f8405e-5fe8-4e57-8155-91f8ced23776", "sighting--22f0d470-1e70-4d6a-beaa-33a7285364de", "sighting--4fa5c6e1-a036-4c58-80e0-63838bf6a3a7", "sighting--778b804f-9138-4f25-a7fd-e853a1e62261", "sighting--60d63f8f-89d6-4fcf-b9e7-bde8856c29b1", "sighting--9177cbc8-f1be-4845-ab49-edb04bff0add", "sighting--222d3e04-bca4-43f9-bb45-f4981b605497", "sighting--31d7bf2a-808b-46b3-827b-c8145fff1ba4", "sighting--0c22576b-672d-4d32-9673-27107e191b96", "sighting--fa1f39fa-2e12-4d9a-9d02-5ff508ee24cf", "sighting--97e3de5a-ae84-475f-8b4d-f9e415d43478", "sighting--736be180-84b6-4b7c-bd40-4d5098902da3", "sighting--b347a47b-253a-4206-9bb4-6d2f9c589553", "sighting--0218d85f-91ca-45f1-beff-23a4a3b8887a", "sighting--cb740654-78d6-4c74-b9f8-354eec3a6a43", "sighting--9b29407d-8e2f-4cc7-bee2-f2a47aaf8ae9", "sighting--8fb0611c-16a1-4dcd-a0c6-6f0a4db2082b", "sighting--ff823228-2b64-40ce-824b-bd3ffd0f3d59", "sighting--89dc98ea-d313-42b1-b78a-88188e1dbd7e", "sighting--aec4e8e7-3c08-4e40-8fea-36d2f415a2d0", "sighting--ccaae97b-ee19-4110-ab2e-d71673e8f13d", "sighting--b2119d9d-b4d2-4287-a7b3-b4bcd3d433d3", "sighting--f877a48f-5786-4d6f-b776-b0ca99562524", "sighting--b74f1257-528e-4789-b93a-ce41859adfcb", "sighting--148bfc59-c714-48de-8387-0da9560f5ad2", "sighting--1c05eeb5-0875-4efb-9313-5a7e5338a5ed", "sighting--c1026f4d-7ab7-4815-be67-7f8f19ddc30f", "sighting--e063e234-715f-4a53-a901-58fa4f3cabf9", "sighting--3ad741dd-ff16-405d-8902-73693092c3f9", "sighting--28917c25-1bf5-4368-ba0d-a47655319801", "sighting--f541ab93-a8af-43c3-a456-c83d75a97e2b", "sighting--83e3fd41-28e3-460c-a543-03286f927b3d", "sighting--d7667876-487d-4b81-a583-f33d5d20bc94", "sighting--219cb877-9114-4506-8291-e2aed4e1c9b9", "sighting--39d7dc98-ed1a-4088-bf29-141858b3bb71", "sighting--209953de-65e1-4a92-bc6e-1582d013dba6", "sighting--36f18024-3a47-4019-b17d-9c08fd108e13", "sighting--ecb978bc-caf4-40e8-a014-28d6154d82ae", "sighting--f7a2eb85-ac5a-41d1-8c47-ea605974f0f5", "sighting--54ee576b-62aa-4291-9580-691e36c64fa7", "sighting--5018e5f9-ed5c-42e6-8f99-2dcf71450513", "sighting--01f0d42d-37d9-4fb3-8cf4-e28982669b21", "sighting--fdcfef36-6d5b-47f3-88f4-2aa7307312e4", "sighting--d6ced53f-a652-4a71-8f7e-32a71818f882", "sighting--ee2d5065-0d39-4480-a80e-e8ea136bc613", "sighting--6785f462-98a4-44e4-9098-11adb943cab8", "sighting--1fb406bf-819d-4373-8f35-0ee3a411062f", "sighting--69ebe59f-d269-44ba-85d1-2495628b3e3c", "sighting--96f1d4a2-c262-4bb5-98aa-d4c93fcead14", "sighting--0b16fa40-292d-4937-9f0c-416c154c3077", "sighting--e1584fad-0eed-4610-b460-5cb810c977f3", "sighting--83f20f80-961f-47ab-a7e0-c255ea9c84d9", "sighting--48208634-d9d9-462e-bb7d-3566178d3813", "sighting--5116f272-a7ff-4bed-b5c7-58635b88a2bb", "sighting--9110bf6d-7085-4bdc-a53d-431a464a2866", "sighting--e718f141-5f48-41fd-a9e5-9d625f9cc808", "sighting--ee681d37-1b89-4214-8153-7744697c0071", "sighting--67a4aa99-5cbb-4291-bf76-0ece850f2851", "sighting--a90ba0f1-0114-4aff-a49a-b0a23c2295e6", "sighting--ff90c658-d368-4f63-99a5-faba06319e45", "sighting--12137857-f0a9-40db-9b6e-b1bccc9a0abd", "sighting--25c1c774-0648-496c-ae69-6c8f38a53d1a", "sighting--ec13eb12-83ef-4b87-811f-6a9ae0a3fc8a", "sighting--ca641e70-f301-4e03-9be2-586f4fad0555", "sighting--98aa98b8-894a-4f35-b29d-7af6e1c1853f", "sighting--5aac5a6e-da1c-4edf-9e3c-f8b6138d666f", "sighting--99893d56-71a5-4e7a-aea1-81be4be25c33", "sighting--97a1581d-0485-4598-900b-0d9383b4868a", "sighting--9a730a2c-704c-43e5-9229-a52ab41b8050", "sighting--ec3fc93e-bb5a-453b-a272-677e903c1ca7", "sighting--f60bfc7f-0781-4c9c-9b29-683083673250", "sighting--a0667ad7-e598-459c-ad3f-9abce5e85f0e", "sighting--945ec999-45f8-45a3-8ccf-7d8e9a2e5bca", "sighting--39dd744c-054a-4cf8-95e1-e6efa93cd2a2", "sighting--c0137911-fff5-4892-8cfa-c01cb9950cf1", "sighting--5b54139c-a297-49af-8855-86aeef1d449f", "sighting--cf9b3779-e73d-4aa7-8a68-712b37d6eb48", "sighting--f4c8823a-bd0a-4a5c-ab44-babde2c2b333", "sighting--d52fd9dd-77f7-4d06-94c8-7639904d285e", "sighting--bfd400ce-30a9-471a-ac0c-b2941f0b5af7", "sighting--8a56562f-6292-4269-9cb7-04c456a7f6c5", "sighting--bdf93bc1-30e4-4b64-b0b3-61168853d2a6", "sighting--f947aaf6-ae82-4cbc-89d8-02560131ab77", "sighting--b086f654-55cb-4310-b25f-ebfc46e911f3", "sighting--eb05ce82-c712-431a-af2e-349450d54e49", "sighting--da745a3c-07bd-4238-9bab-1892570f7ad0", "sighting--6ed01646-b088-4bcd-82bd-c791434d2776", "sighting--0bed9f74-c5f7-470b-b976-8bfb748a8425", "sighting--56c31fec-4a1e-4362-ac58-e3310bc87603", "sighting--d7ea3b70-4c83-4cf0-b973-25b4b2d45739", "sighting--67c550ef-5bc0-491d-ad9f-ec904f12d959", "sighting--76688e7f-c0f9-414f-8446-db73472d0aef", "sighting--2a18343c-2ad4-4bc9-9f8a-6824c9a3c800", "sighting--b429e50a-2a38-477f-ae36-37ebb913272a", "sighting--d3f23c0b-46f4-460b-8cd6-7d210ff5169a", "sighting--dd17f322-fd26-478e-90ea-893d25dff9ea", "sighting--954236f4-5f93-4d19-9ea9-ef7cf38eef89", "sighting--ea527e42-6855-4564-ade8-0a133e0b298b", "sighting--7d6d171b-ae8d-49c0-a40f-e4d1fe749e5c", "sighting--ae97f596-3d93-4a0b-83ef-d733d4eccb7d", "sighting--9dd7a8ce-c353-4a30-bf66-7f03bf1ceb1d", "sighting--62c86ea4-8ec9-484a-a90f-d820c31bdf6b", "sighting--e6dd0405-f5cb-4e37-9dcd-b9fa4919eda3", "sighting--2bfa140a-8001-4e57-8cce-b5c749e90de5", "sighting--ffa51104-88c9-41d2-990c-5bc440920bae", "sighting--43d0d24f-482d-48a4-8f8f-40fe19223bb5", "sighting--ce19c763-067c-4b04-8fe7-67e7ddc7e0cd", "sighting--c2f37297-5697-48ee-bcc5-f88f9e363e8d", "sighting--84a65bb7-97d2-4aaa-b95b-1f5472a5c6d1", "sighting--eb86c4d7-1475-4472-81b1-f72af0db09d2", "sighting--36bfe50e-2570-42c9-bffe-caf7649cbd9f", "sighting--f4149b90-3577-434c-b781-d7c8a6ef4527", "sighting--f7e05b9f-f842-44b9-b5ed-de17412d58c0", "sighting--437b9ca4-9856-4e9a-abe5-593dd53402fe", "sighting--53bc96cf-0df6-49f7-bfc8-0d211caeba1a", "sighting--4cf21e46-79f3-436e-8614-147417adceee", "sighting--374ac9c9-8b1f-41e5-9d62-b39011b9b8c2", "sighting--589b3fe4-b226-42c1-ba17-c2e7cb56f044", "sighting--5ef27531-d219-43b6-8e88-73dd821cc609", "sighting--71568ced-708e-42da-844f-9fa17daba387", "sighting--17689900-5a4e-46ee-a984-2fd8811d029d", "sighting--87077d54-9b66-48f8-9fed-e551276c226d", "sighting--a4f33351-6428-486d-90f6-390b91eed07f", "sighting--23e508a2-ad2a-4abd-962d-1fb852d584f9", "sighting--1dea51c2-d801-451c-a46d-97a957c1ea77", "sighting--cdcea2fc-f1a5-4d0b-b168-5253253c3771", "sighting--206dea20-6f22-429f-9be6-02c8057c625c", "sighting--974eae20-eaab-4fe6-bb1b-926ca39311c7", "sighting--ee4d3c67-77ac-4ec8-b08c-ab2e1831ab45", "sighting--51a0c60e-dba0-41da-938e-4231639d79d3", "sighting--6a55c36e-615f-4895-9eaa-68e764f8678c", "sighting--1dc5371e-c3a6-4d5d-9063-32f945effcde", "sighting--dc7dd412-cb86-45f3-96c8-cead5af42cfd", "sighting--654dff76-e172-45a0-877f-244adc3d0adc", "sighting--faf678a0-b11c-4c2d-918f-173c1169fce8", "sighting--e7107d7a-8ab9-4cf8-84bd-cb32e1d6dfbe", "sighting--3d1f9d4d-a54d-41cd-b1d1-6bcedaad082f", "sighting--0875b5a8-0cf6-4102-b06d-16d907c187a9", "sighting--aa11af9d-4dff-45f4-baf9-8da607341859", "sighting--b9284b8b-e234-4fbf-98c3-53772d70ab7e", "sighting--59fe1a97-c266-4719-b796-86a4f23710ab", "sighting--edaa6902-8978-4280-8002-915192d928c1", "sighting--7357a1ac-642c-46a2-accd-36b03302ccba", "sighting--26385876-994b-4bb1-82a5-5ec6e51e2eaa", "sighting--102a403a-9625-48a9-af34-8c8fcba7da8a", "sighting--153c9664-d015-4330-99e7-b4a28dc24a4b", "sighting--741dfc5c-602e-4fb9-b8a7-1316c6812f57", "sighting--36d8fc6b-a1f8-4d9f-9dc2-cfcd69322487", "sighting--54c27a1c-f8aa-4550-8d0a-eb5e39eafe07", "sighting--44b5b2b7-4029-4a4f-aa23-b1055e37ccd9", "sighting--3453e88b-2e46-4bf2-a42e-61bc96584340", "sighting--5da7077a-5c1c-4ca2-802f-ff0631b474cf", "sighting--1a7d2f77-bc0e-4c32-a498-f1a724f89bc2", "sighting--cd9b5599-5d07-44c7-92b9-9e15e057a0d9", "sighting--bd9feea1-38f2-4603-9c6c-4385a9b80afd", "sighting--50d168f5-77d1-43e5-8b36-0de42818dee9", "sighting--a31329d6-73f6-4fa8-94cf-38e1bba09923", "sighting--7c92541b-4ca4-4c7c-9b8d-5876f7196296", "sighting--e47cbd39-ef83-4b2a-948a-3147b43a8348", "sighting--52614f46-3e2f-44dd-809d-922c353e5f82", "sighting--3705b1cb-cc6b-43bf-83d9-6986938e133a", "sighting--e611f8b3-a126-4188-abff-98bd06cfcff1", "sighting--801ca986-9000-4c9b-ba6e-8f099fbee2a3", "sighting--380b937d-56fd-46fa-9926-460e261f74b9", "sighting--cdea2162-82e9-42d2-bd4e-11894bbe3109", "sighting--62994998-730e-438f-abbf-f4598b7372d2", "sighting--649024a6-14f9-4c12-99d2-87520ff73de1", "sighting--7889007c-e3e5-4dd0-8ceb-625624966b24", "sighting--c759f2dc-cd09-4d12-91f6-e9870583f466", "sighting--b1e99108-a671-4bd9-84e5-090769488512", "sighting--ea865e2b-e569-48e0-a10b-c7c164c9aafa", "sighting--4d01f54b-9bba-4d78-80e6-94bdfb96404d", "sighting--eaeabacd-d46c-47ff-a8f1-b0d4c21c9e79", "sighting--5634e243-8bab-4720-aa5a-800b9fc00c11", "sighting--010ef748-7e62-4801-a10b-ab5d18faa8c3", "sighting--86376f3a-f7d9-4abc-a102-ac63ca7fab55", "sighting--ffa98778-7eee-4cbf-848f-7eb88f1d5e73", "sighting--0e998194-d040-47a0-822d-2d9999631859", "sighting--acbfc5e0-5f22-440a-a43e-43d225d8e711", "sighting--982bc497-1cf4-4449-9173-14b872a7e5c5", "sighting--7a946f2f-9f6c-4fd8-87b5-0e213c93a373", "sighting--ad79f138-1f92-46b6-8c1b-9abfd5c17dcc", "sighting--dcc01854-f943-4344-a967-5225c88e2822", "sighting--a431bb97-d78c-4659-803a-74ff3ca2d6df", "sighting--a6a2b0f5-b7af-4a97-a827-68afcca4b783", "sighting--332c1428-4c8a-4fd9-893c-e4e7912eeecc", "sighting--e5ad763c-281f-4856-af2f-1fccc1d5b451", "sighting--761443b9-e425-446f-96be-be784547cc6e", "sighting--30ae03c1-75b0-41f6-94c0-6fdc9592970b", "sighting--53e67ac0-d846-497f-aecc-43e9466fc0f6", "sighting--da1c3ee6-e3b3-47b0-a13e-03a94040659b", "sighting--ec2d6154-f781-4914-89e6-4f308f1abb6a", "sighting--ff107b11-2aba-43c2-a30c-6ca53472522a", "sighting--70f64a21-5d6c-4899-9884-33483b063371", "sighting--1d98c1ae-d1f0-46b9-a8d8-d026e932933f", "sighting--f3e39efa-cc6c-4cb5-9c51-0165fbb778d2", "sighting--2ead24a6-57bb-4772-a98d-b6d7007b1aef", "sighting--06d5ea1d-ec0f-41dc-ba4c-cdb758062493", "sighting--31215505-2dd9-4199-a8d5-9b3e151c13f7", "sighting--9c75dada-a437-4374-9c42-a0afb5a04c27", "sighting--f12d054f-23e9-4db2-b9c1-f3aa0cda826b", "sighting--86ad645a-d53c-4072-8bd9-d34bdee10acf", "sighting--ceb61b88-ffa8-482b-9540-f58fca570da3", "sighting--1717bb8e-104b-4e82-b2e3-ece2e88ad265", "sighting--9cb421e0-a771-44a4-8f8e-b7d3e5537f67", "sighting--7c9100dd-cb56-4261-8bef-3fa9003774ca", "sighting--ee04f243-3701-4113-96a1-ad8a8f4e30ac", "sighting--a35ad691-202d-46e5-bd76-2f2430a15400", "sighting--8b1a6516-6ad5-4808-9f6e-32d066e24468", "sighting--959f2203-0c75-476d-9689-0e2001ecea4a", "sighting--25bf3cdf-1853-44ff-b460-ade282051928", "sighting--cd8f6970-bd10-4614-9b1f-754b114da06a", "sighting--6777e6e3-57e5-4f74-854b-45d876a79a47", "sighting--7afcd8b1-0a3d-4e25-992b-e412ac7c47c7", "sighting--634205b7-64b8-4922-b1a1-085290d9f004", "sighting--198da894-b3a7-4fc1-9ded-f71d93d70e5b", "sighting--a82ae54b-016a-4b86-95b4-598c9d81323c", "sighting--a9b31f1d-b358-4ceb-a6f1-4e29cdcebadd", "sighting--b0d94550-df91-493e-a19b-1d320e6bc456", "sighting--41345148-eeb0-4f19-8ee6-66753e05e740", "sighting--fbeb874f-bb15-4740-a883-76ea7bf44d18", "sighting--293878b3-eddf-41ae-8e96-7fda99962639", "sighting--6f21b3c0-0772-48ea-90c9-0d18491ae6ef", "sighting--3a368cc1-4649-42b3-8753-b6e90bc39d93", "sighting--7f167571-d46d-42d9-8076-40c8d0d923ae", "sighting--f9b51a33-b675-4083-8008-06880eab8b79", "sighting--2472079d-1d1b-4f3c-a80b-83c2b898df11", "sighting--d828e9e5-814f-4d17-bb60-a1ef83c90f71", "sighting--dc250930-8238-4208-bfa1-b699c97eac17", "sighting--dee2b0a8-9c21-4845-b3ce-c29ae9c88f07", "sighting--1e2d5b0d-d476-454a-97b9-96e80265faf3", "sighting--58208927-7583-450f-8382-fe05d900419a", "sighting--35f6dded-5c4d-47e3-b3e0-d4352062c3d5", "sighting--6cac1000-00a2-4769-a3a5-d48be507f030", "sighting--c1522497-ee0e-4435-8a69-40d34c6b4922", "sighting--4b7e7cac-235c-4246-b8e8-9004d0d14cdc", "sighting--995483ba-bedc-46c9-be17-7921df94d7f7", "sighting--7a2fe33d-8f42-4481-8ef9-04a884d20635", "sighting--1514ee2e-4933-4131-82a8-9d7339bbacb1", "sighting--420e7b89-7eb3-4499-834c-9ba0f62213e7", "sighting--17efe23e-3e3a-4e81-aea7-c867fc66ff11", "sighting--9d32a877-1894-4a7f-8f3e-f47734728ebd", "sighting--49a6748e-303b-41b8-8081-ab822730c975", "sighting--611c38a4-7aa1-4302-9b8f-1f54351e9740", "sighting--41902b73-710e-4338-a79e-18c8a3962109", "sighting--b1f9ac22-105d-4a15-a601-30d3944210f9", "sighting--fa95de52-1fe7-40b7-9ccf-b3a19f8160b6", "sighting--ee06c011-d59f-415f-b8af-d04919bb8161", "sighting--65df76d6-74ca-4716-a8e6-b61f5d727329", "sighting--d01e3cd0-4718-4cae-ab22-7346d53df782", "sighting--47201923-86c5-4184-b663-3682c2977cda"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-18T11:00:03.234Z", "modified": "2026-05-18T11:00:03.234Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}